Getgrav Grav vulnerabilities

CVE-2026-61456 [MEDIUM] CWE-79 CVE-2026-61456: The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded thro The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG c

CVE-2021-3818 [MEDIUM] CWE-565 CVE-2021-3818: grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

CVE-2026-72832 [MEDIUM] CWE-79 CVE-2026-72832: Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the S Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a s

CVE-2026-85601 [MEDIUM] CWE-79 CVE-2026-85601: Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the D Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated admin sessions without requiring site access.

CVE-2026-75107 [MEDIUM] CWE-79 CVE-2026-75107: Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

CVE-2026-72702 [MEDIUM] CWE-346 CVE-2026-72702: Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referr Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://exam

CVE-2026-61453 [MEDIUM] CWE-79 CVE-2026-61453: Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint valida Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dy

CVE-2022-0970 [MEDIUM] CWE-79 CVE-2022-0970: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

CVE-2025-66311 [MEDIUM] CWE-79 CVE-2025-66311: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts

CVE-2026-86197 [MEDIUM] CWE-79 CVE-2026-86197: Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that all Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed f

CVE-2026-59193 [MEDIUM] CWE-409 CVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.

CVE-2026-44737 [MEDIUM] CWE-79 Grav: Stored XSS via page title (data[header][title]) in admin panel Grav: Stored XSS via page title (data[header][title]) in admin panel ### Summary _A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][title] parameter._ --- ### Details Vulnerable Endpoint: GET /admin/pages/[page] Parameter: data[header]

CVE-2026-74908 [MEDIUM] CWE-79 CVE-2026-74908: Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin wh

CVE-2026-75832 [MEDIUM] CWE-862 CVE-2026-75832: The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/ scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual s

CVE-2025-65186 [MEDIUM] CWE-79 CVE-2025-65186: Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated us Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.

CVE-2020-37256 [MEDIUM] CWE-79 CVE-2020-37256: Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor def Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

CVE-2026-42612 [MEDIUM] CWE-79 CVE-2026-42612: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulner Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

CVE-2026-72821 [MEDIUM] CWE-79 CVE-2026-72821: Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

CVE-2025-66310 [MEDIUM] CWE-79 CVE-2025-66310: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts

CVE-2025-66312 [MEDIUM] CWE-79 CVE-2025-66312: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious