getgrav/grav vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-8HGV-XC77-JMCRMediumgetgrav/grav: Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to…CVE-2026-62673Highgetgrav/grav: Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsCVE-2026-53653Highgetgrav/grav: Grav: Unauthenticated denial of service via unbounded image derivative dimensionsCVE-2026-55890Mediumgetgrav/grav: Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhrCVE-2026-55885Mediumgetgrav/grav: Grav: Admin Backup Zip File Exposes Account Credentials and Configuration SecretsCVE-2026-44738Highgetgrav/grav: Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()CVE-2026-44737Mediumgetgrav/grav: Grav: Stored XSS via page title (data[header][title]) in admin panelCVE-2026-42844Highgetgrav/grav: Low-privileged Grav API users can create super-admin accounts via blueprint-uploadCVE-2026-42611Highgetgrav/grav: Grav is Vulnerable to Stored XSS via Tag InjectionGHSA-3446-6MGW-F79PMediumgetgrav/grav: Grav is Vulnerable to XXE via SVG Upload CVE-2026-42608Highgetgrav/grav: Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash componentCVE-2026-42609Highgetgrav/grav: Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite LogicCVE-2026-7317Lowgetgrav/grav: Grav has Insecure Deserialization in File CacheGHSA-VJ3M-2G9H-VM4PCriticalgetgrav/grav: Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypassCVE-2026-42612Highgetgrav/grav: Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event AttributesCVE-2026-42610Mediumgetgrav/grav: Grav Vulnerable to Sensitive Information Disclosure via Accounts Service BypassCVE-2026-42613Criticalgetgrav/grav: Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/accessCVE-2026-42842Mediumgetgrav/grav: Grav Vulnerable to XSS via Taxonomy Field Values in Admin PanelCVE-2026-42841Mediumgetgrav/grav: Grav CMS vulnerable to stored XSS via Markdown media attribute() actionCVE-2026-42607Criticalgetgrav/grav: Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeatureCVE-2025-66844Criticalgetgrav/grav: Grav may be vulnerable to SSRF attack via Twig TemplatesCVE-2025-66843Mediumgetgrav/grav: Grav is vulnerable to Stored XSS through authenticated user-edited contentCVE-2025-65186Mediumgetgrav/grav: Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editorCVE-2025-66298Highgetgrav/grav: Grav is vulnerable to Server-Side Template Injection (SSTI) via FormsCVE-2025-66294Highgetgrav/grav: Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo