Read the docs

Grav

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Grav records in CISA KEV

No Grav vulnerabilities are listed in CISA KEV.

Records

6 records

TI-2026-40880 CVE-2026-56701 · GHSA-3446-6mgw-f79p

Grav - XML External Entity Injection via SVG Upload

Priority MEDIUM 64

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00305 Published 2026-06-23 Fixed in 2.0.0-beta.2 CWE-611
TI-2026-42219 CVE-2026-58654 · GHSA-w3xr-jx24-vw2h

Grav - Arbitrary File Upload via Avatar Endpoint

Priority MEDIUM 57

The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar).

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00436 Published 2026-07-08 Fixed in 1.0.1 CWE-434
TI-2026-42222 CVE-2026-58657 · GHSA-ffmg-hfvg-jhg9

Grav - Stored CSS Injection via Markdown Image resize() Action

Priority MEDIUM 55

Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00267 Published 2026-07-08 Fixed in 2.0.0 CWE-79
Open these records in search →