Getgrav Grav vulnerabilities

CVE-2026-61450 [MEDIUM] CWE-94 CVE-2026-61450: Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the

CVE-2025-46198 [HIGH] CWE-79 CVE-2025-46198: Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to exe Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

CVE-2026-74907 [MEDIUM] CWE-22 CVE-2026-74907: Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.p Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets

CVE-2025-66306 [MEDIUM] CWE-639 CVE-2025-66306: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increa

CVE-2026-72698 [MEDIUM] CWE-200 CVE-2026-72698: Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twi Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the con

CVE-2026-75831 [HIGH] CWE-79 CVE-2026-75831: Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

CVE-2026-55885 [MEDIUM] CWE-312 CVE-2026-55885: Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permi Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the s

CVE-2026-61690 [MEDIUM] CWE-409 CVE-2026-61690: Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Co Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive ca

CVE-2026-62237 [MEDIUM] CWE-1333 CVE-2026-62237: Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophi

CVE-2026-62672 [MEDIUM] CWE-1333 CVE-2026-62672: Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and func Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically

CVE-2026-53654 [MEDIUM] CWE-601 CVE-2026-53654: Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a clie Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRe

CVE-2026-61455 [MEDIUM] CWE-409 CVE-2026-61455: Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks l Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

CVE-2026-85598 [MEDIUM] CWE-79 CVE-2026-85598: Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.

CVE-2026-61449 [MEDIUM] CWE-409 CVE-2026-61449: Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declare

CVE-2026-72823 [MEDIUM] CWE-862 CVE-2026-72823: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a supe

CVE-2026-80204 [MEDIUM] CWE-863 CVE-2026-80204: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot en

CVE-2026-61454 [MEDIUM] CWE-200 CVE-2026-61454: The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav

CVE-2026-61452 [MEDIUM] CWE-613 CVE-2026-61452: The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password chang

CVE-2026-58493 [MEDIUM] CWE-74 CVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PD grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to

CVE-2025-66307 [MEDIUM] CWE-204 CVE-2025-66307: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email