Getgrav Grav vulnerabilities

CVE-2022-0743 [MEDIUM] CWE-79 CVE-2022-0743: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

CVE-2025-66305 [MEDIUM] CWE-248 CVE-2025-66305: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability w Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or

CVE-2026-58657 [MEDIUM] CWE-79 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav ## Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct `?style=` payloads and unsafe `attribute()` fallbacks, but the adjacent `resize()` action still wri

CVE-2026-75833 [MEDIUM] CWE-601 CVE-2026-75833: The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before v The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value

CVE-2026-72701 [LOW] CWE-208 CVE-2026-72701: Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constan Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, weakening CSRF protection below its

CVE-2025-64059 [LOW] CWE-79 CVE-2025-64059: Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of thi Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.