getgrav

Records229All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical27CVSS 9.0–10.0

CVSS high123CVSS 7.0–8.9

Exploited now

getgrav records in CISA KEV

No getgrav vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Grav 57 records HIGH Grav-plugin-admin 9 records HIGH Grav Cms 5 records MEDIUM Dom-sanitizer 1 record LOW Grav-plugin-api 1 record HIGH Grav Admin 1 record LOW

Records

57 records in Grav · all components

TI-2025-28971 CVE-2025-46199 · GHSA-c22x-w4fr-9xmp

Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to…

HIGH 82

Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00927 Published 2025-07-25 No fix listed CWE-79

TI-2021-22428 CVE-2021-47812 · GHSA-474v-g7v9-75hp

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

HIGH 81

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02203 Published 2026-01-15 No fix listed CWE-862

TI-2025-41064 CVE-2025-66844 · GHSA-729w-j79f-2c34

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig…

HIGH 80

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00291 Published 2025-12-15 No fix listed CWE-918

TI-2026-30888 CVE-2026-42608 · GHSA-hmcx-ch82-3fv2

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

HIGH 79

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00603 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-22

TI-2025-40773 CVE-2025-66299 · GHSA-gjc5-8cfh-653x

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

HIGH 79

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00652 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

TI-2025-40768 CVE-2025-66294 · GHSA-662m-56v4-3r8f

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

HIGH 79

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03019 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

TI-2023-17087 CVE-2023-34252 · GHSA-96xv-rmwj-6p9w

Grav Server-side Template Injection via Insufficient Validation in filterFilter

HIGH 79

Grav is a flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02074 Published 2023-06-14 Fixed in 1.7.42 CWE-1336

TI-2025-40775 CVE-2025-66301 · GHSA-v8x2-fjv7-8hjh

Improper authorization in getgrav grav

HIGH 78

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.01433 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-285

TI-2024-22539 CVE-2024-34082 · GHSA-f8v5-jmfh-pr69

Grav Arbitrary File Read to Account Takeover

HIGH 76

Grav is a file-based Web platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.03045 Published 2024-05-15 Fixed in 1.7.46 CWE-269

TI-2023-17086 CVE-2023-34251 · GHSA-f9jf-4cp4-4fq5

Grav Server Side Template Injection vulnerability

HIGH 76

Grav is a flat-file content management system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.02338 Published 2023-06-14 Fixed in 1.7.42 CWE-94

TI-2024-18526 CVE-2024-27921 · GHSA-m7hx-hw6h-mqmc

Grav File Upload Path Traversal vulnerability

HIGH 75

Grav is an open-source, flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.60585 Published 2024-03-21 Fixed in 1.7.45 CWE-22

TI-2025-40771 CVE-2025-66297 · GHSA-858q-77wx-hhx6

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

HIGH 74

Grav is a file-based Web platform.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00839 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

TI-2026-31053 CVE-2026-42844 · GHSA-6xx2-m8wv-756h

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

HIGH 73

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00336 Published 2026-05-12 Fixed in 2.0.0-beta.4 CWE-269

TI-2025-40770 CVE-2025-66296 · GHSA-cjcp-qxvg-4rjm

Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

HIGH 73

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00341 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-266

TI-2025-28970 CVE-2025-46198 · GHSA-gjr2-rg47-2hq9

Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an…

HIGH 73

Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00729 Published 2025-07-25 No fix listed CWE-79

TI-2024-18699 CVE-2024-28119 · GHSA-2m7x-c7px-hp58

Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler

HIGH 73

Grav is an open-source, flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01584 Published 2024-03-21 Fixed in 1.7.45 CWE-94

TI-2024-18698 CVE-2024-28118 · GHSA-r6vw-8v8r-pmp4

Grav vulnerable to Server Side Template Injection (SSTI)

HIGH 73

Grav is an open-source, flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0122 Published 2024-03-21 Fixed in 1.7.45 CWE-94

TI-2024-18697 CVE-2024-28117 · GHSA-qfv4-q44r-g7rv

Grav vulnerable to Server Side Template Injection (SSTI)

HIGH 73

Grav is an open-source, flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01394 Published 2024-03-21 Fixed in 1.7.45 CWE-94

TI-2024-18696 CVE-2024-28116 · GHSA-c9gp-64c4-2rrh

Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

HIGH 73

Grav is an open-source, flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05807 Published 2024-03-21 Fixed in 1.7.45 CWE-1336

TI-2024-18528 CVE-2024-27923 · GHSA-f6g2-h7qv-3m5v

Remote Code Execution by uploading a phar file using frontmatter

HIGH 73

Grav is a content management system (CMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01357 Published 2024-03-06 Fixed in 1.7.43 CWE-287

TI-2023-19330 CVE-2023-37897 · GHSA-9436-3gmp-4f53

Server-side Template Injection (SSTI) in grav

HIGH 73

Grav is a file-based Web-platform built in PHP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02809 Published 2023-07-18 Fixed in 1.7.42.2 CWE-393

TI-2023-17274 CVE-2023-34448 · GHSA-whr7-m3f8-mpm8

Grav Server-side Template Injection (SSTI) via Twig Default Filters

HIGH 73

Grav is a flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04515 Published 2023-06-14 Fixed in 1.7.42 CWE-1336

TI-2023-17088 CVE-2023-34253 · GHSA-j3v8-v77f-fvgm

Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

HIGH 73

Grav is a flat-file content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02074 Published 2023-06-14 Fixed in 1.7.42 CWE-1336

TI-2026-30891 CVE-2026-42611 · GHSA-w8cg-7jcj-4vv2

Grav: Stored XSS via Tag Injection

HIGH 72

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.003 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-79

TI-2025-40769 CVE-2025-66295 · GHSA-h756-wh59-hhjv

Path traversal in getgrav grav

HIGH 71

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00591 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-22

Open these records in search →