Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: getgrav grav 2.0.4 Clear all filters
TI-2026-44460 CVE-2026-62237 · GHSA-6gqg-9qjp-56jm

Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Priority MEDIUM 60

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00301 Published 2026-07-17 Fixed in 2.0.4 CWE-1333
TI-2026-44457 CVE-2026-62234 · GHSA-rv94-vqvr-wjjh

Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Priority HIGH 70

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00368 Published 2026-07-17 Fixed in 2.0.4 CWE-918
TI-2026-44455 CVE-2026-62232 · GHSA-4m9m-rmh9-2pgf

Grav < 2.0.4 2FA Bypass via Secret Regeneration

Priority HIGH 74

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00352 Published 2026-07-17 Fixed in 2.0.4 CWE-862
TI-2026-44453 CVE-2026-62230 · GHSA-5mv9-76r9-rprq

Grav < 2.0.4 File Access Bypass via Case Variation

Priority HIGH 77

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00381 Published 2026-07-17 Fixed in 2.0.4 CWE-178