Grav CMS: 14 Vulnerabilities Including Critical Privilege Escalation Disclosed Together
A batch of 14 vulnerabilities, including critical privilege escalation and high-severity flaws, were disclosed for Grav CMS on August 18-19, 2026.
Key findings
- 14 vulnerabilities disclosed for Grav CMS between August 18-19, 2026, impacting core and plugins.
- Critical CVE-2026-75837 allows privilege escalation to super-admin for delegated administrators.
- High severity flaws include arbitrary file write (CVE-2026-75827) and code execution via dynamic data (CVE-2026-64850).
- Multiple stored XSS vulnerabilities (CVE-2026-62672, CVE-2026-75834, CVE-2026-75831) and path traversal (CVE-2026-74907) were found.
- Affected versions include Grav core < 2.0.15 and API plugin < 1.0.15; patches are available.
On August 18-19, 2026, a batch of 14 vulnerabilities was disclosed for the Grav CMS, affecting its core system and several plugins. The vulnerabilities, ranging in severity from Medium to Critical, highlight security weaknesses that could allow for privilege escalation, arbitrary file writes, cross-site scripting (XSS), and more. Immediate updates are recommended for all affected components.
Several vulnerabilities revolve around improper handling of user-supplied data and insufficient authorization checks. CVE-2026-75837, a Critical severity flaw, allows a delegated administrator to escalate their privileges to super-admin by manipulating the access field in the core group blueprint. This grants them scheduler and Twig evaluation capabilities.
High severity vulnerabilities include CVE-2026-64850 and CVE-2026-75827, both related to improper validation in the Grav\\Common\\Data\\Blueprint::dynamicData() and Grav\\Common\\Filesystem\\ZipArchiver::extract() functions, respectively. These flaws could allow attackers to execute arbitrary code or write arbitrary files. CVE-2026-75836, affecting the Grav API plugin, also carries a High severity rating due to a failure to enforce authorization requirements, potentially allowing unauthorized access to API actions.
Medium severity vulnerabilities address various issues. CVE-2026-62672 and CVE-2026-75834 point to stored XSS vulnerabilities, with the former allowing authenticated page editors to inject malicious content via the regex_replace filter, and the latter exploiting an issue with XSS detection patterns. CVE-2026-61690 and CVE-2026-74907 involve insecure archive extraction and path traversal, respectively. CVE-2026-53654 in the Login plugin allows unauthenticated requests to set external redirect targets, while CVE-2026-61842 and CVE-2026-75832 highlight issues with configuration object serialization and missing authorization in the API plugin. CVE-2026-75107, found in the Grav Form Plugin, allows for HTML and JavaScript injection through unescaped form template properties.
The disclosures include fixes for Grav core versions prior to 2.0.15, and the Grav API plugin versions prior to 1.0.15. Specific fixes include updates to the Login plugin (prior to 3.8.5) and the Grav Form Plugin (prior to 9.1.19). Users are urged to update to the patched versions to mitigate these risks.
This batch of vulnerabilities underscores the importance of keeping Grav CMS and its associated plugins updated. The range of issues, from privilege escalation to XSS and file manipulation, presents a significant risk to installations that remain unpatched. Users should consult the official Grav security advisories for detailed information on affected versions and the steps required to secure their installations.