Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: getgrav grav 2.2.5 Clear all filters
TI-2026-79159 CVE-2026-114660 · GHSA-78r2-qf6v-6gr4

Unauthorized page deletion in Grav via Flex form directives

Priority LOW 30

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatte…

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00211 Published 2026-10-22 Fixed in 2.2.5 CWE-470
TI-2026-79156 CVE-2026-114657 · GHSA-84ch-j6rx-rh66

Grav discloses HTTP Basic credentials through Twig Uri output

Priority LOW 30

Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00217 Published 2026-10-22 Fixed in 2.2.5 CWE-200