Skip to contentGetgrav Grav vulnerabilities
- getgrav gravGrav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query ParameterCVE-2026-586568.7 High
- getgrav gravGrav - Arbitrary File Upload via Avatar EndpointCVE-2026-586545.3 Medium
- getgrav grav-plugin-apiStored XSS via missing XSS safety check in Admin2 Pages API partial validationCVE-2026-119825.1 Medium
- getgrav gravGrav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()CVE-2026-55890Fix available4.8 Medium
- getgrav gravGrav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsCVE-2026-55885Fix available6.8 Medium
- getgrav gravGrav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()CVE-2026-44738Fix available7.7 High
- getgrav grav-plugin-admingrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]CVE-2026-44737Fix available6.2 Medium
- getgrav grav-plugin-formGrav: Anonymous Page Content Overwrite via Form File Upload filename OverrideCVE-2026-42845Fix available7.7 High
- getgrav gravGrav: Low-privileged API users can create super-admin accounts via blueprint-uploadCVE-2026-42844Fix available8.7 High
- getgrav gravGrav: Stored XSS via Tag InjectionCVE-2026-42611Fix available8.9 High
- getgrav gravGrav - XML External Entity Injection via SVG UploadCVE-2026-56701Fix available7.1 High
- getgrav gravGrav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.CVE-2026-42608Fix available8.8 High
- getgrav gravGrav: Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicCVE-2026-42609Fix available8.1 High
- getgrav gravGrav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command InjectionCVE-2026-56700Fix available9.3 Critical
- getgrav gravGrav: Publisher-Level Stored XSS via Unquoted Event AttributesCVE-2026-42612Fix available8.5 High
- getgrav gravGrav: Sensitive Information Disclosure via Accounts Service BypassCVE-2026-42610Fix available6.5 Medium
- getgrav gravGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessCVE-2026-42613Public exploitFix available9.4 Critical
- getgrav grav, grav-plugin-form +1 moregrav-plugin-form: XSS via Taxonomy Field Values in Admin PanelCVE-2026-42842Fix available5.4 Medium
- getgrav gravGrav: Stored XSS via Markdown media attribute() action in Grav CMSCVE-2026-42841Fix available6.9 Medium
- getgrav gravGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeatureCVE-2026-42607Public exploitFix available9.1 Critical
- getgrav grav-plugin-apigrav-plugin-api: Grav API Privilege Escalation to Super AdminCVE-2026-42843Fix available8.8 High
- getgrav gravGrav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload...CVE-2026-299247.6 High
- getgrav grav cms admin pluginGrav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site ScriptingCVE-2020-369555.1 Medium
- getgrav grav, gravcms +1 moreGravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)CVE-2021-478129.3 Critical
- getgrav gravGrav may be vulnerable to SSRF attack via Twig TemplatesCVE-2025-668449.1 Critical
- getgrav gravGrav is vulnerable to Stored XSS through authenticated user-edited contentCVE-2025-668435.4 Medium
- getgrav gravGrav CMS is vulnerable to Cross Site Scripting (XSS) in the page editorCVE-2025-651866.1 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`CVE-2025-66312Fix available6.2 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parametersCVE-2025-66311Fix available6.2 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced TabCVE-2025-66310Fix available6.2 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tabCVE-2025-66309Fix available6.2 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`CVE-2025-66308Fix available6.8 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav Admin Plugin vulnerable to User Enumeration & Email DisclosureCVE-2025-66307Fix available6.5 Medium
- getgrav gravGrav vulnerable to Information Disclosure via IDOR in Grav Admin PanelCVE-2025-66306Fix available4.3 Medium
- getgrav gravGrav vulnerable to Denial of Service via Improper Input Handling in 'Supported' ParameterCVE-2025-66305Fix available6.9 Medium
- getgrav gravGrav Exposes Password Hashes Leading to privilege escalationCVE-2025-66304Fix available6.2 Medium
- getgrav gravGrav is vulnerable to a DOS on the admin panelCVE-2025-66303Fix available4.9 Medium
- getgrav gravGrav vulnerable to Path Traversal allowing server files backupCVE-2025-66302Fix available6.8 Medium
- getgrav gravGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsCVE-2025-66301Public exploitFix available8.6 High
- getgrav gravGrav is vulnerable to Arbitrary File ReadCVE-2025-66300Fix available8.5 High
- getgrav gravSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMSCVE-2025-66299Fix available8.8 High
- getgrav gravGrav is vulnerable to Server-Side Template Injection (SSTI) via FormsCVE-2025-66298Fix available7.7 High
- getgrav gravGrav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig InjectionCVE-2025-66297Fix available7.4 High
- getgrav gravGrav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account TakeoverCVE-2025-66296Fix available8.8 High
- getgrav gravGrav is vulnerable to RCE via SSTI through Twig Sandbox BypassCVE-2025-66294Public exploitFix available8.7 High
- getgrav gravGrav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System CorruptionCVE-2025-66295Fix available8.8 High
- getgrav gravGrav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS).CVE-2025-635936.1 Medium
- getgrav gravA Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to...CVE-2025-50286Public exploitEPSS 15.7%8.1 High
- getgrav gravCross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute...CVE-2025-461999.8 Critical
- getgrav gravCross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to...CVE-2025-461988.8 High
- Show moreLoading…