Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: getgrav grav 2.0.11 Clear all filters
TI-2026-48496 CVE-2026-69089 · GHSA-w3f4-8pj2-599w

Grav CMS before 2.0.11 Path Traversal via watermark

Priority HIGH 73

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource().

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00459 Published 2026-08-03 Fixed in 2.0.11 CWE-22
TI-2026-48495 CVE-2026-69088 · GHSA-7pgq-cr25-xvc8

Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Priority HIGH 72

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00295 Published 2026-08-03 Fixed in 2.0.11 CWE-94