Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: Grav Clear all filters
TI-2026-42222 CVE-2026-58657 · GHSA-ffmg-hfvg-jhg9

Grav - Stored CSS Injection via Markdown Image resize() Action

Priority MEDIUM 55

Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00267 Published 2026-07-08 Fixed in 2.0.0 CWE-79
TI-2026-42219 CVE-2026-58654 · GHSA-w3xr-jx24-vw2h

Grav - Arbitrary File Upload via Avatar Endpoint

Priority MEDIUM 57

The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar).

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00436 Published 2026-07-08 Fixed in 1.0.1 CWE-434
TI-2026-40880 CVE-2026-56701 · GHSA-3446-6mgw-f79p

Grav - XML External Entity Injection via SVG Upload

Priority MEDIUM 64

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00305 Published 2026-06-23 Fixed in 2.0.0-beta.2 CWE-611