Getgrav Grav vulnerabilities

CVE-2026-61451 [CRITICAL] CWE-601 CVE-2026-61451: The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-suppli The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitra

CVE-2024-27923 [HIGH] CWE-287 CVE-2024-27923: Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may u Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

CVE-2024-28118 [HIGH] CWE-94 CVE-2024-28118: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unr Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative us

CVE-2026-72826 [HIGH] CWE-266 CVE-2026-72826: The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly create The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attac

CVE-2026-65895 [HIGH] CWE-862 CVE-2026-65895: Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin con Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include

CVE-2026-80203 [CRITICAL] CWE-863 CVE-2026-80203: The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSup The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). A

CVE-2025-66295 [HIGH] CWE-22 CVE-2025-66295: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creati Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain accoun

CVE-2026-56710 [CRITICAL] CWE-863 CVE-2026-56710: Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in th Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissio

CVE-2026-62233 [HIGH] CWE-639 CVE-2026-62233: grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

CVE-2026-53653 [HIGH] CWE-770 CVE-2026-53653: Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated vi Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension o

CVE-2026-64850 [HIGH] CWE-94 CVE-2026-64850: Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/ Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecu

CVE-2026-61873 [HIGH] CWE-73 CVE-2026-61873: Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.f Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to wri

CVE-2026-62232 [HIGH] CWE-862 CVE-2026-62232: Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen

CVE-2026-62231 [HIGH] CWE-863 CVE-2026-62231: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any wr

CVE-2026-75829 [HIGH] CWE-1336 CVE-2026-75829: grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, al grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.

CVE-2023-34448 [HIGH] CVE-2023-34448: Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code

CVE-2020-29555 [HIGH] CWE-22 Grav CMS Arbitrary File Deletion Grav CMS Arbitrary File Deletion The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

CVE-2018-5233 [MEDIUM] CWE-79 Grav CMS Cross-site scripting (XSS) vulnerability Grav CMS Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in `system/src/Grav/Common/Twig/Twig.php` in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.

CVE-2026-72825 [HIGH] CWE-862 CVE-2026-72825: The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /r The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never c

CVE-2026-75837 [CRITICAL] CWE-269 CVE-2026-75837: Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required sec Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.