VYPR

Packagist (Composer) package

getgrav/grav

pkg:composer/getgrav/grav

Vulnerabilities (68)

  • CVE-2026-62673HigAug 19, 2026
    affected < 2.0.4fixed 2.0.4

    Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthent

  • CVE-2026-62669HigAug 19, 2026
    affected < 2.0.4fixed 2.0.4

    Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password

  • CVE-2026-61842MedAug 19, 2026
    affected < 2.0.2fixed 2.0.2

    Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurity

  • CVE-2026-61690MedAug 19, 2026
    affected < 2.0.1fixed 2.0.1

    Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code usi

  • CVE-2026-42844HigMay 12, 2026
    affected < 2.0.0-beta.4fixed 2.0.0-beta.4

    Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This r

  • CVE-2026-44738HigMay 11, 2026
    affected < 2.0.0-rc.2fixed 2.0.0-rc.2

    Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys,

  • CVE-2026-44737MedMay 11, 2026
    affected < 1.7.49.5fixed 1.7.49.5

    grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] paramete

  • CVE-2026-42842MedMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin pa

  • CVE-2026-42841MedMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image qu

  • CVE-2026-42613CriMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and groups or access are in

  • CVE-2026-42612HigMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted

  • CVE-2026-42611HigMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever

  • CVE-2026-42610MedMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative u

  • CVE-2026-42609HigMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a u

  • CVE-2026-42608CriMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create ar

  • CVE-2026-42607CriMay 11, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to block direct .php file

  • CVE-2026-7317MedApr 28, 2026
    affected < 2.0.0-beta.2fixed 2.0.0-beta.2

    A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization.

  • CVE-2025-66844CriDec 15, 2025
    affected <= 1.7.49.5

    In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

  • CVE-2025-66843MedDec 15, 2025
    affected <= 1.7.49.5

    grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the s

  • CVE-2025-65186MedDec 2, 2025
    affected <= 1.7.49

    Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize tags, allowing stored XSS payloads to execute when pages are viewed in the admin inte

Page 1 of 4