Getgrav Grav vulnerabilities

CVE-2026-75831 [HIGH] CWE-79 CVE-2026-75831: Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

CVE-2026-55885 [MEDIUM] CWE-312 CVE-2026-55885: Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permi Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the s

CVE-2026-62672 [MEDIUM] CWE-1333 CVE-2026-62672: Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and func Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically

CVE-2026-53654 [MEDIUM] CWE-601 CVE-2026-53654: Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a clie Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRe

CVE-2026-62237 [MEDIUM] CWE-1333 CVE-2026-62237: Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophi

CVE-2026-61455 [MEDIUM] CWE-409 CVE-2026-61455: Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks l Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

CVE-2026-85598 [MEDIUM] CWE-79 CVE-2026-85598: Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.

CVE-2026-72823 [MEDIUM] CWE-862 CVE-2026-72823: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a supe

CVE-2026-61454 [MEDIUM] CWE-200 CVE-2026-61454: The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav

CVE-2026-61449 [MEDIUM] CWE-409 CVE-2026-61449: Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declare

CVE-2026-100667 [MEDIUM] CWE-304 CVE-2026-100667: grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor aut grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had suc

CVE-2026-56708 [MEDIUM] CWE-367 CVE-2026-56708: Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delive Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach

CVE-2026-58493 [MEDIUM] CWE-74 CVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PD grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call builds PDO DSN strings by directly concatenating user-configurable YAML values from fields such as host, dbname, charset, server, database, directory, and filename without sanitization or validation, allowing an administrator with plugin configuration access to

CVE-2026-109324 [MEDIUM] CWE-409 CVE-2026-109324: Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailabili

CVE-2026-114657 [MEDIUM] CWE-200 CVE-2026-114657: Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page autho Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an e

CVE-2026-80204 [MEDIUM] CWE-863 CVE-2026-80204: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab() function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin()/hasPermission() checks without a request parameter, it cannot en

CVE-2025-66307 [MEDIUM] CWE-204 CVE-2025-66307: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email

CVE-2026-61452 [MEDIUM] CWE-613 CVE-2026-61452: The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation vulnerability where JWT access tokens are issued without a jti (JWT ID) claim and therefore cannot be revoked server-side. Unlike refresh tokens, access tokens remain valid for their full lifetime (default 1 hour) regardless of logout, password chang

CVE-2026-72820 [MEDIUM] CWE-22 CVE-2026-72820: Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

CVE-2020-29556 [MEDIUM] CWE-22 Grav CMS Local File Injection Grav CMS Local File Injection The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)