Getgrav Grav vulnerabilities

CVE-2026-72695 [HIGH] CWE-22 CVE-2026-72695: Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that al Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths co

CVE-2026-42609 [HIGH] CWE-269 CVE-2026-42609: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's me

CVE-2026-69088 [HIGH] CWE-94 CVE-2026-69088: Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class:: Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_t

CVE-2022-2073 [HIGH] CWE-94 CVE-2022-2073: Code Injection in GitHub repository getgrav/grav prior to 1.7.34. Code Injection in GitHub repository getgrav/grav prior to 1.7.34.

CVE-2026-62673 [HIGH] CWE-178 CVE-2026-62673: Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester can use uppercase directory or extension variants to byp

CVE-2026-62234 [HIGH] CWE-918 CVE-2026-62234: Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

CVE-2026-69089 [HIGH] CWE-22 CVE-2026-69089: Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image

CVE-2026-62230 [HIGH] CWE-178 CVE-2026-62230: Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rul Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can requ

CVE-2026-62669 [HIGH] CWE-287 CVE-2026-62669: Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Gra Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOT

CVE-2025-66844 [CRITICAL] CWE-918 CVE-2025-66844: In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates w In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

CVE-2023-34253 [HIGH] CWE-184 CVE-2023-34253: Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in c Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names,

CVE-2026-29924 [HIGH] CWE-611 CVE-2026-29924: Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload fu Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

CVE-2026-58656 [HIGH] CWE-598 CVE-2026-58656: Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and respo Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Refer

CVE-2026-72828 [HIGH] CWE-269 CVE-2026-72828: Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in Invit Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitatio

CVE-2023-34252 [HIGH] CWE-184 CVE-2023-34252: Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipp

CVE-2026-44738 [HIGH] CWE-200 CVE-2026-44738: Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administra

CVE-2026-62386 [HIGH] CWE-598 CVE-2026-62386: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through t The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and cap

CVE-2025-66304 [HIGH] CWE-200 CVE-2025-66304: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user accoun Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-

CVE-2021-3924 [HIGH] CWE-22 CVE-2021-3924: grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2023-34251 [HIGH] CWE-94 CVE-2023-34251: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server sid Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.