Grav CMS: Six Vulnerabilities Including File Write and XSS Disclosed Together
Six vulnerabilities, including arbitrary file write and XSS, were disclosed for Grav CMS and its plugins on August 18, 2026, with patches now available.
Key findings
- Six vulnerabilities disclosed for Grav CMS on August 18, 2026, including High severity flaws.
- Key issues include arbitrary file write (CVE-2026-75827) and path traversal (CVE-2026-74907).
- Stored XSS vulnerabilities affect Grav core (CVE-2026-75831, CVE-2026-75834) and plugins (CVE-2026-75107).
- Affected versions range from Grav API plugin < 1.0.14 to Grav core < 2.0.15.
- Patches are available; immediate updates are recommended for all affected components.
On August 18, 2026, a batch of six vulnerabilities was disclosed for the Grav CMS, impacting its core system and several plugins. These vulnerabilities, ranging in severity from Medium to High, were all published on the same day, indicating a coordinated disclosure event. The most critical issues include arbitrary file write, path traversal, and cross-site scripting (XSS) flaws, posing significant risks to Grav installations if left unpatched.
Several of the disclosed vulnerabilities stem from improper input sanitization and validation. CVE-2026-75831, a stored XSS vulnerability in the audio and video media rendering, allows attackers to inject malicious HTML and JavaScript by manipulating media URLs. Similarly, CVE-2026-75834, another stored XSS flaw, arises from an incomplete XSS detection mechanism that can be bypassed with invalid UTF-8 characters, leading to script execution in viewers' browsers. The Grav Form Plugin is also affected by an XSS vulnerability (CVE-2026-75107) due to unescaped field-definition properties, allowing attackers with form authoring privileges to inject code.
Security researchers also identified critical vulnerabilities related to file manipulation and access control. CVE-2026-75827, an arbitrary file write vulnerability, exploits an incomplete denylist in the Blueprint dynamic-data validation. Attackers with page-edit or blueprint-config access can leverage this to write PHP payloads to the server by invoking the error_log function. Furthermore, CVE-2026-74907, a path traversal vulnerability in the static asset server, allows unauthenticated attackers to access files in sibling directories by crafting specific directory names. The Grav API plugin is also impacted by CVE-2026-75836, a vulnerability that fails to enforce authorization for certain API actions, potentially allowing unauthorized access to menubar item listings.
The disclosed vulnerabilities affect various versions of Grav CMS. Specifically, Grav versions prior to 2.0.14 are vulnerable to CVE-2026-75834, and versions prior to 2.0.15 are affected by CVE-2026-75831, CVE-2026-75827, and CVE-2026-74907. The Grav API plugin is vulnerable before version 1.0.14 (CVE-2026-75836), and the Grav Form Plugin is vulnerable before version 9.1.19 (CVE-2026-75107). Patches are available for these issues, with users urged to update to the latest versions to mitigate the risks.
This coordinated disclosure highlights the importance of timely patching for Grav CMS installations. The presence of multiple high-severity vulnerabilities, including arbitrary file write and path traversal, necessitates immediate attention from administrators. Users should prioritize updating their Grav core and relevant plugins to the patched versions to protect their websites from potential compromise.
CVE-2026-75836: Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 CVE-2026-75834: Grav before 2.0.14 CVE-2026-75831: Grav before 2.0.15 CVE-2026-75827: Grav before 2.0.15 CVE-2026-75107: Grav Form Plugin before 9.1.19 CVE-2026-74907: Grav before 2.0.15