Grav CMS: Eight Vulnerabilities Including Path Traversal and Auth Bypass Disclosed Together
Key findings • Eight vulnerabilities in Grav CMS and its plugins were disclosed on August 25, 2026, with fixes available in updated versions. • Flaws include path traversal, unauthorized file…
Key findings
- Eight vulnerabilities in Grav CMS and its plugins were disclosed on August 25, 2026, with fixes available in updated versions.
- Flaws include path traversal, unauthorized file access/deletion, and Twig sandbox escapes affecting core CMS and plugins.
- A critical vulnerability in the Login plugin allows bypassing brute-force protection on admin accounts.
- The Email plugin is vulnerable to Twig injection, and the Flex Objects plugin has an authorization bypass.
- Users must update Grav CMS to 2.0.16+, Email plugin to 4.2.2+, and Login plugin to 3.9.1+ to patch these issues.
On August 25, 2026, a batch of eight vulnerabilities was disclosed for the Grav CMS and its associated plugins, with fixes released in Grav CMS versions 2.0.16, Grav Email plugin 4.2.2, and Grav Login plugin 3.9.1. These vulnerabilities, ranging in severity from Medium to Critical, were all disclosed on the same day, indicating a coordinated disclosure event. The flaws primarily involve path traversal, insecure direct object references, and template injection, posing significant risks to Grav installations.
Several vulnerabilities center on path traversal and unauthorized file access. CVE-2026-72697 and CVE-2026-72695, both rated Medium and High respectively, exploit flaws in the media_directory() Twig function and MediaUploadTrait::deleteFile() method. These allow authenticated users with page authoring or media management permissions to access or delete arbitrary files outside their intended scope by manipulating filesystem paths and filenames. Additionally, CVE-2026-72696, a High severity vulnerability, involves symlink following in Scheduler Job::createLockFile(), enabling local attackers to overwrite arbitrary files by pre-creating symlinks in world-writable temporary directories.
A critical vulnerability, CVE-2026-56710 (Critical, CVSSv3 9.8), affects the Grav Login plugin. It fails to validate the target account's privilege level in the onApiUserListRowAction unlock handler. This allows an attacker with api.users.write permission to bypass brute-force protection on administrator accounts by clearing lockout counters on admin.super accounts. Another significant flaw, CVE-2026-75574 (High, CVSSv3 8.8), impacts the Grav Email plugin. Versions before 4.2.2 render page-editor-controlled email action parameters as unsandboxed Twig templates, allowing authenticated remote users to inject malicious Twig expressions into email bodies, potentially leading to code execution.
Further vulnerabilities include CVE-2026-56709 (High, CVSSv3 7.5), which involves insecure handling of the Host header in the sendInvitationEmail() function. Attackers can manipulate this header to poison invitation links, redirecting users to malicious domains and bypassing trusted host protection. CVE-2026-56709 affects Grav versions before 3.9.2. Lastly, CVE-2026-72699 (Medium, CVSSv3 5.3) in the Grav Login plugin before 3.9.1 allows for email address enumeration. The registration process throws a distinct exception when an email is already in use, enabling attackers to identify existing accounts.
The Grav Flex Objects plugin is also affected by CVE-2026-56707 (High, CVSSv3 7.7), where versions 1.4.0 through 1.4.7 contain an authorization bypass in the flex-objects shortcode. This allows users with page-edit access to render any registered Flex collection without proper permission checks, potentially exposing sensitive directory information.
All identified vulnerabilities have been addressed by the Grav team. Users are strongly advised to update Grav CMS to version 2.0.16 or later, the Email plugin to 4.2.2 or later, and the Login plugin to 3.9.1 or later. The Flex Objects plugin should be updated to versions past 1.4.7. Prompt updates are crucial to mitigate risks associated with path traversal, unauthorized file access, privilege escalation, and sensitive data exposure.
This coordinated disclosure highlights the importance of keeping Grav CMS and its plugins updated, especially given the range of critical and high-severity issues affecting core functionalities like user authentication, file management, and templating. Users with page-edit or content-edit permissions appear to be at a higher risk for certain configuration leaks and unauthorized access scenarios.
The batch of vulnerabilities disclosed on August 25, 2026, for Grav CMS and its plugins includes critical and high-severity flaws. Path traversal vulnerabilities in Grav CMS core and plugins allow authenticated users to access or delete arbitrary files. A critical flaw in the Grav Login plugin enables attackers to bypass brute-force protection on administrator accounts. The Grav Email plugin is vulnerable to Twig sandbox escapes, allowing for potential code execution via crafted email content. An authorization bypass in the Grav Flex Objects plugin allows unauthorized access to sensitive directory information. Users are urged to update Grav CMS to 2.0.16+, Email plugin to 4.2.2+, and Login plugin to 3.9.1+ to patch these vulnerabilities. CVE-2026-75574, CVE-2026-72699, CVE-2026-72697, CVE-2026-72696, CVE-2026-72695, CVE-2026-56710, CVE-2026-56709, CVE-2026-56707