getgrav/grav

Vulnerabilities (72)

• CVE-2026-62673HigAug 19, 2026
  affected < 2.0.4fixed 2.0.4

  Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthent

• CVE-2026-62672MedAug 19, 2026
  affected < 2.0.4fixed 2.0.4

  Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is

• CVE-2026-62669HigAug 19, 2026
  affected < 2.0.4fixed 2.0.4

  Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password

• CVE-2026-61842MedAug 19, 2026
  affected < 2.0.2fixed 2.0.2

  Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurity

• CVE-2026-61690MedAug 19, 2026
  affected < 2.0.1fixed 2.0.1

  Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code usi

• CVE-2026-61453MedJul 15, 2026
  affected >= 2.0.0, < 2.0.1fixed 2.0.1

  Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-wri

• CVE-2026-59193MedJul 10, 2026
  affected >= 1.0.0, < 2.0.0fixed 2.0.0

  Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed si

• CVE-2026-58657MedJul 8, 2026
  affected >= 2.0.0-rc.9, < 2.0.0fixed 2.0.0

  Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpt

• CVE-2026-42844HigMay 12, 2026
  affected < 2.0.0-beta.4fixed 2.0.0-beta.4

  Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This r

• CVE-2026-44738HigMay 11, 2026
  affected < 2.0.0-rc.2fixed 2.0.0-rc.2

  Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys,

• CVE-2026-44737MedMay 11, 2026
  affected < 1.7.49.5fixed 1.7.49.5

  grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] paramete

• CVE-2026-42842MedMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin pa

• CVE-2026-42841MedMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image qu

• CVE-2026-42613CriMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are in

• CVE-2026-42612HigMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted

• CVE-2026-42611HigMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever

• CVE-2026-42610MedMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative u

• CVE-2026-42609HigMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a u

• CVE-2026-42608CriMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create ar

• CVE-2026-42607CriMay 11, 2026
  affected < 2.0.0-beta.2fixed 2.0.0-beta.2

  Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file