Getgrav Grav vulnerabilities

CVE-2024-28119 [HIGH] CWE-94 CVE-2024-28119: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unr Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or ed

CVE-2026-58655 [HIGH] CWE-94 CVE-2026-58655: The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stor The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(

CVE-2026-72819 [HIGH] CWE-94 CVE-2026-72819: Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin set Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicio

CVE-2025-66296 [HIGH] CWE-266 CVE-2025-66296: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exis Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, a

CVE-2024-28116 [HIGH] CWE-94 CVE-2024-28116: Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vul Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this i

CVE-2024-28117 [HIGH] CWE-94 CVE-2024-28117: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can

CVE-2026-42608 [CRITICAL] CWE-22 CVE-2026-42608: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability wi Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-c

CVE-2026-65897 [HIGH] CWE-269 CVE-2026-65897: Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::c Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-ad

CVE-2026-42844 [HIGH] CWE-269 CVE-2026-42844: Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user wit Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerabil

CVE-2026-65603 [HIGH] CWE-269 CVE-2026-65603: The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an ad

CVE-2026-75836 [HIGH] CWE-862 CVE-2026-75836: The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.1 The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only

CVE-2026-75574 [HIGH] CWE-1336 CVE-2026-75574: The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitra

CVE-2026-72829 [HIGH] CWE-269 CVE-2026-72829: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a r

CVE-2025-66300 [HIGH] CWE-22 CVE-2025-66300: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page ed Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise

CVE-2026-62668 [CRITICAL] CWE-918 CVE-2026-62668: Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An ac

CVE-2026-58492 [CRITICAL] CWE-89 CVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists metho grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against th

CVE-2025-66299 [HIGH] CWE-94 CVE-2025-66299: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side T Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible

CVE-2026-72831 [HIGH] CWE-863 CVE-2026-72831: The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authen

CVE-2026-72822 [HIGH] CWE-306 CVE-2026-72822: The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is ne

CVE-2023-37897 [HIGH] CWE-74 CVE-2023-37897: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to exec