getgrav/grav vulnerabilities
CVEs whose affected-version data names the getgrav/grav package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
50 CVEsRSS
CVE-2026-72697High· 6.5Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
CVE-2026-72695High· 8.1Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
CVE-2026-72702LowGrav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
CVE-2026-72701Low· 3.7Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
CVE-2026-72698High· 6.5Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
CVE-2026-76846High· 7.5Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
CVE-2026-76839High· 7.7Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
CVE-2026-65608High· 8.8Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
CVE-2026-69088High· 8.1Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
CVE-2026-69089HighGrav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
CVE-2026-61449Medium· 6.5Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
CVE-2026-61453MediumGrav: XSS Blueprint Validation Bypass via Twig String Concatenation
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-58657Medium· 4.8Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
GHSA-896w-cw95-xq7wHigh· 8.1Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
GHSA-qh7h-6c7g-x8m6Critical· 5.4Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
GHSA-px9v-979x-qmh9Medium· 3.7Duplicate Advisory: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Duplicate Advisory: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
GHSA-rj4c-4q9x-543xHigh· 6.5Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
GHSA-mw85-cjh9-8hp7High· 6.5Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
GHSA-crrc-vpp2-f5x7High· 7.5Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
GHSA-8vp7-8q4w-vv7mHigh· 6.5Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
GHSA-8hgv-xc77-jmcrMediumGrav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
CVE-2026-62669High· 7.4Grav Login Plugin adds login, basic ACL, and session wide messages to Grav
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. A…
CVE-2026-61690Medium· 6.5Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, fi…
CVE-2026-61842Medium· 6.5Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that …
CVE-2026-64850HighGrav is a file-based Web platform
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dan…
CVE-2026-62673HighGrav is a file-based Web platform
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On …
GHSA-fwwx-3362-3947Critical· 8.8Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
GHSA-9pr6-8r9w-wvmjCritical· 8.7Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
GHSA-993v-76jg-67xrMedium· 5.4Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
GHSA-m97h-2qj3-5773Critical· 9.1Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin