Getgrav Grav vulnerabilities

CVE-2026-65007 [CRITICAL] CWE-862 CVE-2026-65007: The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation an The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any u

CVE-2026-72819 [HIGH] CWE-94 CVE-2026-72819: Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin set Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicio

CVE-2025-66297 [HIGH] CWE-1336 CVE-2025-66297: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permis Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This resu

CVE-2024-28119 [HIGH] CWE-94 CVE-2024-28119: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unr Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or ed

CVE-2026-75574 [HIGH] CWE-1336 CVE-2026-75574: The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitra

CVE-2024-28116 [HIGH] CWE-94 CVE-2024-28116: Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vul Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this i

CVE-2024-28117 [HIGH] CWE-94 CVE-2024-28117: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can

CVE-2026-72829 [HIGH] CWE-269 CVE-2026-72829: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a r

CVE-2026-65897 [HIGH] CWE-269 CVE-2026-65897: Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::c Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-ad

CVE-2026-42844 [HIGH] CWE-269 CVE-2026-42844: Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user wit Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerabil

CVE-2026-72822 [HIGH] CWE-306 CVE-2026-72822: The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is ne

CVE-2026-75836 [HIGH] CWE-862 CVE-2026-75836: The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.1 The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize(), the POST /api/v1/menubar/actions/{plugin}/{action} endpoint only

CVE-2026-100670 [HIGH] CWE-639 CVE-2026-100670: Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and accoun Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as `access.admin.super` (instead of the nested `access[admin][super]`) matches no blueprint

CVE-2026-65603 [HIGH] CWE-269 CVE-2026-65603: The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the registration handler, this handler does not strip privilege fields ('groups','access') from user-submitted form data before persisting them. When an ad

CVE-2025-66296 [HIGH] CWE-266 CVE-2025-66296: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exis Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, a

CVE-2026-61451 [CRITICAL] CWE-601 CVE-2026-61451: The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-suppli The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitra

CVE-2026-62668 [CRITICAL] CWE-918 CVE-2026-62668: Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An ac

CVE-2026-58492 [CRITICAL] CWE-89 CVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists metho grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against th

CVE-2026-112780 [HIGH] CWE-749 CVE-2026-112780: Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting dire

CVE-2026-72831 [HIGH] CWE-863 CVE-2026-72831: The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authen