Getgrav Grav vulnerabilities

CVE-2023-34252 [HIGH] CWE-184 CVE-2023-34252: Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipp

CVE-2026-56707 [HIGH] CWE-862 CVE-2026-56707: Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account i

CVE-2026-44738 [HIGH] CWE-200 CVE-2026-44738: Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administra

CVE-2026-62386 [HIGH] CWE-598 CVE-2026-62386: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through t The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and cap

CVE-2021-3924 [HIGH] CWE-22 CVE-2021-3924: grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2026-61450 [MEDIUM] CWE-94 CVE-2026-61450: Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the

CVE-2026-100671 [HIGH] CWE-200 CVE-2026-100671: Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x o Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including

CVE-2023-34251 [HIGH] CWE-94 CVE-2023-34251: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server sid Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.

CVE-2026-92917 [HIGH] CWE-200 CVE-2026-92917: Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to re Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the glob

CVE-2026-72700 [HIGH] CWE-208 CVE-2026-72700: The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset an The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (taskReset) also lacks rate limiting,

CVE-2025-66304 [HIGH] CWE-200 CVE-2025-66304: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user accoun Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-

CVE-2025-46199 [CRITICAL] CWE-79 CVE-2025-46199: Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitra Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

CVE-2026-109326 [HIGH] CWE-527 CVE-2026-109326: Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

CVE-2026-65896 [HIGH] CWE-73 CVE-2026-65896: Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pa

CVE-2026-72696 [HIGH] CWE-59 CVE-2026-72696: Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process

CVE-2026-112782 [HIGH] CWE-400 CVE-2026-112782: Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyt

CVE-2025-66298 [HIGH] CWE-1336 CVE-2025-66298: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal t Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerabilit

CVE-2026-76846 [HIGH] CWE-522 CVE-2026-76846: Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fa Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

CVE-2026-85603 [MEDIUM] CWE-73 CVE-2026-85603: Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As ac Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attack

CVE-2026-72697 [MEDIUM] CWE-22 CVE-2026-72697: Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig functio Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed f