Vulnerabilities

TI-2026-42340 CVE-2026-59193 · GHSA-2vcx-h8p2-9pg9

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

MEDIUM 64

Grav is a file-based Web platform.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.006 Published 2026-07-10 Fixed in 2.0.0 CWE-409

TI-2020-19390 CVE-2020-37256 · GHSA-gwrh-r2g6-7wgp

Grav - Cross-Site Scripting in Admin Plugin Page Editor

LOW 23

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00287 Published 2026-06-25 Fixed in 1.6.30 CWE-79

TI-2026-31053 CVE-2026-42844 · GHSA-6xx2-m8wv-756h

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

HIGH 73

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00336 Published 2026-05-12 Fixed in 2.0.0-beta.4 CWE-269

TI-2026-32625 CVE-2026-44738 · GHSA-j274-39qw-32c9

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

HIGH 67

Grav is a file-based Web platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00276 Published 2026-05-11 Fixed in 2.0.0-rc.2 CWE-200

TI-2026-30892 CVE-2026-42612 · GHSA-9695-8fr9-hw5q

Grav: Publisher-Level Stored XSS via Unquoted Event Attributes

HIGH 70

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-79

TI-2026-30891 CVE-2026-42611 · GHSA-w8cg-7jcj-4vv2

Grav: Stored XSS via Tag Injection

HIGH 72

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.003 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-79

TI-2026-30890 CVE-2026-42610 · GHSA-3f29-pqwf-v4j4

Grav: Sensitive Information Disclosure via Accounts Service Bypass

MEDIUM 62

Grav is a file-based Web platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0029 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-863

TI-2026-30889 CVE-2026-42609 · GHSA-rr73-568v-28f8

Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

HIGH 68

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00463 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-269

TI-2026-30888 CVE-2026-42608 · GHSA-hmcx-ch82-3fv2

Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.

HIGH 79

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00603 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-22

TI-2026-31050 CVE-2026-42841 · GHSA-r7fx-8g49-7hhr

Grav: Stored XSS via Markdown media attribute() action in Grav CMS

MEDIUM 64

Grav is a file-based Web platform.

CVSS 4.0MEDIUM 6.9 Network High privileges User interaction EPSS 0.0042 Published 2026-05-11 Fixed in 2.0.0-beta.2 CWE-79

TI-2026-23399 CVE-2026-29924 · GHSA-fx6g-q2xm-rmch

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG…

LOW 33

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00345 Published 2026-03-30 No fix listed CWE-611

TI-2021-22428 CVE-2021-47812 · GHSA-474v-g7v9-75hp

GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

HIGH 81

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02203 Published 2026-01-15 No fix listed CWE-862

TI-2025-41064 CVE-2025-66844 · GHSA-729w-j79f-2c34

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig…

HIGH 80

In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00291 Published 2025-12-15 No fix listed CWE-918

TI-2025-41063 CVE-2025-66843 · GHSA-mh85-44c2-3m97

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the…

MEDIUM 58

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00162 Published 2025-12-15 No fix listed CWE-79

TI-2025-40284 CVE-2025-65186 · GHSA-cchq-397m-q2qm

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).

MEDIUM 60

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0024 Published 2025-12-02 No fix listed CWE-79

TI-2025-40780 CVE-2025-66306 · GHSA-4cwq-j7jv-qmwg

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

MEDIUM 62

Grav is a file-based Web platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00316 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-639

TI-2025-40779 CVE-2025-66305 · GHSA-m8vh-v6r6-w7p6

Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

HIGH 70

Grav is a file-based Web platform.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00414 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-248

TI-2025-40778 CVE-2025-66304 · GHSA-gq3g-666w-7h85

Grav Exposes Password Hashes Leading to privilege escalation

HIGH 67

Grav is a file-based Web platform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0044 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-200

TI-2025-40777 CVE-2025-66303 · GHSA-x62q-p736-3997

Grav is vulnerable to a DOS on the admin panel

MEDIUM 56

Grav is a file-based Web platform.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00415 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-400

TI-2025-40776 CVE-2025-66302 · GHSA-j422-qmxp-hv94

Grav vulnerable to Path Traversal allowing server files backup

MEDIUM 63

Grav is a file-based Web platform.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00514 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-22

TI-2025-40775 CVE-2025-66301 · GHSA-v8x2-fjv7-8hjh

Improper authorization in getgrav grav

HIGH 78

Grav is a file-based Web platform.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.01433 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-285

TI-2025-40774 CVE-2025-66300 · GHSA-p4ww-mcp9-j6f2

Grav is vulnerable to Arbitrary File Read

HIGH 70

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00486 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-22

TI-2025-40773 CVE-2025-66299 · GHSA-gjc5-8cfh-653x

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

HIGH 79

Grav is a file-based Web platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00652 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

TI-2025-40772 CVE-2025-66298 · GHSA-8535-hvm8-2hmv

Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms

HIGH 67

Grav is a file-based Web platform.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00405 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

TI-2025-40771 CVE-2025-66297 · GHSA-858q-77wx-hhx6

Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection

HIGH 74

Grav is a file-based Web platform.

CVSS 4.0HIGH 7.4 Network Low privileges No interaction EPSS 0.00839 Published 2025-12-01 Fixed in 1.8.0-beta.27 CWE-1336

Vulnerabilities

Filters