Getgrav Grav vulnerabilities

CVE-2026-72826 [HIGH] CWE-266 CVE-2026-72826: The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly create The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attac

CVE-2026-80203 [CRITICAL] CWE-863 CVE-2026-80203: The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSup The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). A

CVE-2024-27923 [HIGH] CWE-287 CVE-2024-27923: Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may u Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.

CVE-2024-28118 [HIGH] CWE-94 CVE-2024-28118: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unr Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative us

CVE-2025-66299 [HIGH] CWE-94 CVE-2025-66299: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side T Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible

CVE-2025-66300 [HIGH] CWE-22 CVE-2025-66300: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page ed Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise

CVE-2026-65895 [HIGH] CWE-862 CVE-2026-65895: Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin con Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include

CVE-2023-37897 [HIGH] CWE-74 CVE-2023-37897: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to exec

CVE-2026-56710 [CRITICAL] CWE-863 CVE-2026-56710: Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in th Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissio

CVE-2026-116019 [HIGH] CWE-749 CVE-2026-116019: Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to inv Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils

CVE-2026-64850 [HIGH] CWE-94 CVE-2026-64850: Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/ Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecu

CVE-2025-66295 [HIGH] CWE-22 CVE-2025-66295: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creati Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain accoun

CVE-2026-62233 [HIGH] CWE-639 CVE-2026-62233: grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

CVE-2026-53653 [HIGH] CWE-770 CVE-2026-53653: Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated vi Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request parameters to ImageMedium magic actions without a dimension o

CVE-2026-61873 [HIGH] CWE-73 CVE-2026-61873: Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.f Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to wri

CVE-2026-109325 [HIGH] CWE-200 CVE-2026-109325: Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profi Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

CVE-2026-75829 [HIGH] CWE-1336 CVE-2026-75829: grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, al grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection payloads that are evaluated at render time.

CVE-2018-5233 [MEDIUM] CWE-79 Grav CMS Cross-site scripting (XSS) vulnerability Grav CMS Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in `system/src/Grav/Common/Twig/Twig.php` in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/tools.

CVE-2026-62231 [HIGH] CWE-863 CVE-2026-62231: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any wr

CVE-2026-72825 [HIGH] CWE-862 CVE-2026-72825: The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /r The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never c