Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: getgrav grav 1.0.15 Clear all filters
TI-2026-53076 CVE-2026-75830 · GHSA-r93f-38mc-xpvv

grav-plugin-api before 1.0.15 Path Traversal via batchCopy

Priority MEDIUM 64

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-18 Fixed in 1.0.15 CWE-73
TI-2026-53075 CVE-2026-75829 · GHSA-2jqg-x237-hwx2

grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint

Priority LOW 37

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00407 Published 2026-08-18 Fixed in 1.0.15 CWE-1336
TI-2026-52625 CVE-2026-74908 · GHSA-88pj-3rjg-jjc5

Grav plugin-api before 1.0.15 Script Injection via SVG

Priority LOW 23

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00255 Published 2026-08-18 Fixed in 1.0.15 CWE-79