Vulnerabilities

TI-2026-64827 CVE-2026-100671 · GHSA-jcv9-gfgx-wjw4

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

HIGH 72

Grav is a flat-file CMS.

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00367 Published 2026-09-26 Fixed in 2.0.25 CWE-200

TI-2026-64826 CVE-2026-100670 · GHSA-xw59-q7ph-pgh5

HIGH 73

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00383 Published 2026-09-26 Fixed in 2.0.25 CWE-639

TI-2026-64825 CVE-2026-100669 · GHSA-cxcx-pfx3-w4vx

HIGH 77

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00443 Published 2026-09-26 Fixed in 2.0.25 CWE-178

TI-2026-64824 CVE-2026-100668 · GHSA-g565-6qmq-w49v

LOW 31

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00281 Published 2026-09-26 Fixed in 2.0.25 CWE-200