Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: getgrav grav 2.1.7 Clear all filters
TI-2026-71142 CVE-2026-109326 · GHSA-7mh9-rw55-r7vq

Information disclosure in Grav exposes nested .git directories

Priority MEDIUM 44

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00349 Published 2026-10-12 Fixed in 2.1.7 CWE-527
TI-2026-71140 CVE-2026-109324 · GHSA-fr83-pf82-gwp5

Memory exhaustion in Grav via oversized image transforms

Priority LOW 31

Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0032 Published 2026-10-12 Fixed in 2.1.7 CWE-409
TI-2026-71131 CVE-2026-109315 · GHSA-r6g3-r4xj-3p43

Information disclosure in Grav Clockwork debugger token via Twig sandbox

Priority LOW 31

Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00298 Published 2026-10-12 Fixed in 2.1.7 CWE-200