Getgrav Grav vulnerabilities

CVE-2026-62232 [HIGH] CWE-862 CVE-2026-62232: Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen

CVE-2020-29555 [HIGH] CWE-22 Grav CMS Arbitrary File Deletion Grav CMS Arbitrary File Deletion The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

CVE-2026-69088 [HIGH] CWE-94 CVE-2026-69088: Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class:: Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_t

CVE-2026-100669 [HIGH] CWE-178 CVE-2026-100669: Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matche Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config (IIS), every deny rule (user_sensitive_folders, user_accounts, user_data, user_error_redirect, user_pages, system, vendor, ignore_folders) sets ignoreCase="false" on its URL Rewrite element, overridi

CVE-2026-75837 [CRITICAL] CWE-269 CVE-2026-75837: Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required sec Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.

CVE-2023-34448 [HIGH] CVE-2023-34448: Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code

CVE-2026-72695 [HIGH] CWE-22 CVE-2026-72695: Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that al Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths co

CVE-2026-42609 [HIGH] CWE-269 CVE-2026-42609: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's me

CVE-2026-69089 [HIGH] CWE-22 CVE-2026-69089: Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image

CVE-2026-62673 [HIGH] CWE-178 CVE-2026-62673: Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to byp

CVE-2026-62234 [HIGH] CWE-918 CVE-2026-62234: Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

CVE-2026-92916 [HIGH] CWE-200 CVE-2026-92916: Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint is exposed without authentication: InitializeProcessor::handleDebuggerRequest() intercepts any path containing /__clockwork/ during bootstrap and passes

CVE-2026-62669 [HIGH] CWE-287 CVE-2026-62669: Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Gra Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOT

CVE-2022-2073 [HIGH] CWE-94 CVE-2022-2073: Code Injection in GitHub repository getgrav/grav prior to 1.7.34. Code Injection in GitHub repository getgrav/grav prior to 1.7.34.

CVE-2026-72828 [HIGH] CWE-269 CVE-2026-72828: Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in Invit Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitatio

CVE-2023-34253 [HIGH] CWE-184 CVE-2023-34253: Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in c Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names,

CVE-2026-29924 [HIGH] CWE-611 CVE-2026-29924: Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload fu Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

CVE-2026-62230 [HIGH] CWE-178 CVE-2026-62230: Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rul Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can requ

CVE-2026-58656 [HIGH] CWE-598 CVE-2026-58656: Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and respo Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Refer

CVE-2025-66844 [CRITICAL] CWE-918 CVE-2025-66844: In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates w In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered