Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: getgrav grav 2.0.13 Clear all filters
TI-2026-51053 CVE-2026-72827 · GHSA-4jrc-qc5x-3wrr

Grav CMS before 2.0.13 Remote Code Execution via Twig

Priority HIGH 73

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0085 Published 2026-08-14 Fixed in 2.0.13 CWE-1336
TI-2026-51046 CVE-2026-72820 · GHSA-qf4h-jxxc-wvr9

Grav 2.0.11 Path Traversal via Backup Profile Configuration

Priority MEDIUM 64

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00498 Published 2026-08-14 Fixed in 2.0.13 CWE-22
TI-2026-51045 CVE-2026-72819 · GHSA-r94f-hx44-8jqf

Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Priority HIGH 73

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00902 Published 2026-08-14 Fixed in 2.0.13 CWE-94