Getgrav Grav vulnerabilities

CVE-2020-37256 [MEDIUM] CWE-79 CVE-2020-37256: Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor def Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

CVE-2026-42612 [MEDIUM] CWE-79 CVE-2026-42612: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulner Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2.

CVE-2025-66843 [MEDIUM] CWE-79 CVE-2025-66843: grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editi grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected

CVE-2026-42842 [MEDIUM] CWE-79 CVE-2026-42842: The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Si The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user ca

CVE-2026-66400 [MEDIUM] CWE-613 CVE-2026-66400: Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares

CVE-2026-75832 [MEDIUM] CWE-862 CVE-2026-75832: The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/ scope on the account's raw super-admin ACL flag (access.api.super) instead of validating the presented API key's actual s

CVE-2023-34452 [MEDIUM] CWE-79 CVE-2023-34452: Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browse

CVE-2025-66309 [MEDIUM] CWE-79 CVE-2025-66309: This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Gra This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scrip

CVE-2022-0268 [MEDIUM] CWE-79 CVE-2022-0268: Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28. Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.

CVE-2026-75834 [MEDIUM] CWE-79 CVE-2026-75834: Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to return false for every pattern, silently bypassing the save-tim

CVE-2026-72821 [MEDIUM] CWE-79 CVE-2026-72821: Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

CVE-2019-16126 [MEDIUM] CWE-79 Cross-site Scripting in Grav Cross-site Scripting in Grav Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.

CVE-2026-42841 [MEDIUM] CWE-79 CVE-2026-42841: Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing pe Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public a

CVE-2022-1173 [MEDIUM] CWE-79 CVE-2022-1173: stored xss in GitHub repository getgrav/grav prior to 1.7.33. stored xss in GitHub repository getgrav/grav prior to 1.7.33.

CVE-2023-31506 [MEDIUM] CWE-79 CVE-2023-31506: A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authent A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

CVE-2026-62236 [MEDIUM] CWE-352 CVE-2026-62236: grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the lo grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter an

CVE-2025-66303 [MEDIUM] CWE-400 CVE-2025-66303: Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability h Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quo

CVE-2026-75835 [MEDIUM] CWE-862 CVE-2026-75835: Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerabili Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a result, an authenticated attacker holding a scoped

CVE-2025-63593 [MEDIUM] CWE-79 CVE-2025-63593: Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).

CVE-2021-3904 [MEDIUM] CWE-79 CVE-2021-3904: grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scrip grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')