Getgrav Grav vulnerabilities

CVE-2026-56707 [HIGH] CWE-862 CVE-2026-56707: Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account i

CVE-2025-46199 [CRITICAL] CWE-79 CVE-2025-46199: Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitra Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

CVE-2026-65896 [HIGH] CWE-73 CVE-2026-65896: Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pa

CVE-2025-66298 [HIGH] CWE-1336 CVE-2025-66298: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal t Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerabilit

CVE-2026-72700 [HIGH] CWE-208 CVE-2026-72700: The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset an The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting,

CVE-2026-72696 [HIGH] CWE-59 CVE-2026-72696: Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process

CVE-2026-85603 [MEDIUM] CWE-73 CVE-2026-85603: Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As ac Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attack

CVE-2026-72697 [MEDIUM] CWE-22 CVE-2026-72697: Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig functio Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed f

CVE-2026-42611 [HIGH] CWE-79 CVE-2026-42611: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to crea Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use o

CVE-2026-75828 [HIGH] CWE-79 CVE-2026-75828: Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

CVE-2026-76846 [HIGH] CWE-522 CVE-2026-76846: Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fa Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

CVE-2026-76839 [MEDIUM] CWE-522 CVE-2026-76839: Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-lis Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

CVE-2026-56709 [HIGH] CWE-350 CVE-2026-56709: Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function whe Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

CVE-2026-75830 [HIGH] CWE-73 CVE-2026-75830: grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (

CVE-2026-62235 [MEDIUM] CWE-636 CVE-2026-62235: Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any di

CVE-2026-62387 [HIGH] CWE-942 CVE-2026-62387: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather

CVE-2025-66302 [MEDIUM] CWE-22 CVE-2025-66302: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been i Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied

CVE-2026-42610 [MEDIUM] CWE-863 CVE-2026-42610: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes

CVE-2026-61842 [HIGH] CWE-200 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) ### Summary The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can't read config secrets via `config`. That's bypassable: `grav` is the raw c

CVE-2020-29553 [HIGH] CWE-352 Grav CMS Cross-Site Request Forgery (CSRF) Grav CMS Cross-Site Request Forgery (CSRF) The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).