Getgrav CMS: Eight Vulnerabilities Including High Severity Flaws Disclosed Together
Getgrav CMS and its API plugin were hit with eight vulnerabilities, including High severity flaws like XSS, path traversal, and template injection, disclosed August 18-19, 2026.
Key findings
- Eight vulnerabilities disclosed for Getgrav CMS between August 18-19, 2026, affecting core and API plugin.
- High severity flaws include JWT parameter acceptance, path traversal, server-side template injection, and stored XSS.
- Multiple medium severity issues involve missing authorization checks and script injection via unsanitized files.
- Affected versions include Grav core < 2.0.15 and API plugin < 1.0.15; patches are available.
On August 18-19, 2026, a batch of eight vulnerabilities was disclosed for the Getgrav CMS, impacting its core system and plugins. These vulnerabilities, ranging in severity from Medium to High, highlight security weaknesses in the Grav API plugin and the core CMS. The disclosures were clustered around August 18-19, 2026, with a span of one day.
Several vulnerabilities center on the Grav API plugin (getgrav/grav-plugin-api). CVE-2026-63408, a High severity flaw, allows JWTs to be accepted from URL query parameters on state-changing API endpoints, potentially leading to unauthorized actions. CVE-2026-75830, also High severity, is a path traversal vulnerability in the batchCopy method that, despite a prior fix, still allows authenticated users to access unintended files. CVE-2026-75829, another High severity vulnerability, involves insufficient validation of Twig content in the translate() endpoint, enabling server-side template injection for users with api.pages.write permission. Additionally, CVE-2026-74908, a Medium severity issue, permits script injection through unsanitized .svgz and .xhtml files due to an incomplete SVG sanitizer.
Authorization issues are prominent within the API plugin. CVE-2026-75835 and CVE-2026-75832, both Medium severity, suffer from missing authorization checks. CVE-2026-75835's userPassesAuthorize() function fails to validate API key scopes, relying instead on super-admin flags. Similarly, CVE-2026-75832's resolveUserScope() method incorrectly gates the users/<name> scope based on the super-admin ACL flag rather than proper validation. CVE-2026-62670, a Medium severity flaw, arises from the requireFlexPermission() method in the Flex Objects Admin Next API, which fails to deny access when a directory blueprint omits specific permissions.
Beyond the API plugin, a High severity stored cross-site scripting (XSS) vulnerability, CVE-2026-75828, affects Grav core versions prior to 2.0.15. The detectXss() function fails to properly handle unpaired quotes in unquoted attribute values, allowing authenticated editors to inject event handlers that execute in visitor browsers when page content is rendered.
The affected versions include Grav core versions prior to 2.0.15 and the Grav API plugin versions prior to 1.0.15. Patches are available for these vulnerabilities, with specific fixes noted for the API plugin, such as version 1.0.0-rc.16 for CVE-2026-63408, 1.4.3 for CVE-2026-62670, and 1.0.15 for CVE-2026-75829, CVE-2026-75832, and CVE-2026-74908. CVE-2026-75835 and CVE-2026-75830 were fixed in API plugin version 1.0.14.
This batch of vulnerabilities underscores the importance of timely patching for both Grav core and its plugins, particularly the API plugin, which appears to be a significant attack vector. Users are advised to update to the latest available versions to mitigate these risks. The clustering of these disclosures suggests a coordinated effort in vulnerability discovery and reporting.