CVE-2026-7317 Grav CMS Cache Value FileCache.php doGet deserialization

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be...

EUVD-2026-26154

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be...

CVE-2026-7317

Grav CMS (up to 1.7.49.5/2.0.0-beta.1) contains a deserialization vulnerability in FileCache::doGet (Cache Value Handler, file system/src/Grav/Framework/Cache/Adapter/FileCache.php). The issue allows remote exploitation with high complexity and a publicly available exploit. Upgrading to version 2...

CVE-2026-42844

creationtimestamp| type| source ---|---|--- 2026-04-28 18:04:30+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h...

Grav CMS 输入验证错误漏洞

Grav CMS is a file-based content management system developed under the open-source Grave project. Versions of Grav CMS prior to 1.7.49.5 and 2.0.0-beta.1 contain a vulnerability related to input validation errors. This vulnerability stems from a function in the component Cache Value Handler,...

PT-2026-35830

Name of the Vulnerable Software and Affected Versions Grav CMS versions 1.7.44 through 2.0.0-beta.1 Description An insecure deserialization issue exists in the Cache Value Handler component. The doGet function within the system/src/Grav/Framework/Cache/Adapter/FileCache.php file uses unserialize...

CVE-2026-7317: Deserialization of Untrusted Data

A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be...

CVE-2026-42608

creationtimestamp| type| source ---|---|--- 2026-04-27 12:17:38+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2 2026-05-28 12:55:11+00:00| seen| https://t.me/codebysec/10152 2026-09-26 00:00:27+00:00| seen|...

CVE-2026-42610

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:45+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4...

CVE-2026-42842

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:07+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f...

CVE-2026-42841

creationtimestamp| type| source ---|---|--- 2026-04-27 12:14:51+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr 2026-07-10 18:00:20+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqcq3rslpl25...

Grav CMS Authenticated Scanner

This Python script is a safe, read-only scanner designed to detect whether a target running Grav CMS with its Admin plugin may be vulnerable to CVE-2025-50286, based purely on version analysis...

📄 Grav CMS 1.7.49.5 Shell Upload

This script targets a Grav CMS administrative panel by first authenticating, then checking version information to estimate vulnerability exposure. If conditions are met, it generates a malicious PHP plugin containing a base64-encoded payload and uploads it as a ZIP package through the “direct...

grav-cms-filecache-object-injection

Grav CMS FileCache Object Injection Description The File...

Metasploit Wrap-Up 04/03/2026

Additional Adapters and More Modules This week, we added a whole new bunch of HTTP/HTTPS-based CMD payloads for X64 and X86 versions of Windows. The additional breadth of selectable payloads and delivery techniques allows users new options to tailor the attack workflow for their environment. This...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

📄 Grav CMS 1.7.49.5 Remote Code Execution

Grav CMS versions 1.7.49.5 and below with Admin Plugin versions 1.10.49.3 and below are vulnerable to an authenticated remote code execution vulnerability via the "Direct Install" feature in the administrative interface. An authenticated administrator can upload a crafted plugin archive containin...

EUVD-2026-17148

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

XML External Entity (XXE) Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SVG file upload functionality in the admin panel and File Manager plugin. An attacker can access...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...