Getgrav Grav vulnerabilities

CVE-2026-42611 [HIGH] CWE-79 CVE-2026-42611: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to crea Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use o

CVE-2026-75828 [HIGH] CWE-79 CVE-2026-75828: Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

CVE-2026-56709 [HIGH] CWE-350 CVE-2026-56709: Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function whe Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

CVE-2026-76839 [MEDIUM] CWE-522 CVE-2026-76839: Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-lis Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

CVE-2026-75830 [HIGH] CWE-73 CVE-2026-75830: grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (

CVE-2026-62235 [MEDIUM] CWE-636 CVE-2026-62235: Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any di

CVE-2026-62387 [HIGH] CWE-942 CVE-2026-62387: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather

CVE-2026-42610 [MEDIUM] CWE-863 CVE-2026-42610: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes

CVE-2026-61842 [HIGH] CWE-200 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) ### Summary The Twig content sandbox replaces `config` with the redacted `SandboxConfig` facade and strips `Config::get`/`toArray` from the method allowlist (GHSA-j274-39qw-32c9), so editor content can't read config secrets via `config`. That's bypassable: `grav` is the raw c

CVE-2020-29553 [HIGH] CWE-352 Grav CMS Cross-Site Request Forgery (CSRF) Grav CMS Cross-Site Request Forgery (CSRF) The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).

CVE-2025-66302 [MEDIUM] CWE-22 CVE-2025-66302: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been i Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied

CVE-2025-46198 [HIGH] CWE-79 CVE-2025-46198: Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to exe Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

CVE-2026-72698 [MEDIUM] CWE-200 CVE-2026-72698: Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twi Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the con

CVE-2026-109315 [MEDIUM] CWE-200 CVE-2026-109315: Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page edit Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it as X-Clockwork-Auth to read profiler records with configuration, reque

CVE-2026-74907 [MEDIUM] CWE-22 CVE-2026-74907: Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.p Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base path string, such as requesting assets-secret when assets

CVE-2026-112781 [MEDIUM] CWE-200 CVE-2026-112781: Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page edito Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwor

CVE-2025-66306 [MEDIUM] CWE-639 CVE-2025-66306: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increa

CVE-2026-100668 [MEDIUM] CWE-200 CVE-2026-100668: Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identic Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but is registered without the needs_is_sandboxed guard that print_r, vardump, json_encode, yaml_encode and string carry, and its implementation calls toArray() — or falls back to an (array) cast — withou

CVE-2026-61690 [MEDIUM] CWE-409 CVE-2026-61690: Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Co Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive ca

CVE-2026-114660 [MEDIUM] CWE-470 CVE-2026-114660: Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dyn Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStorageKey() and delete() run in their session, deleti