2165 matches found
Cross-site Scripting (XSS)
Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...
Path Traversal
Grav is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of directory paths in MediaUploadTrait::deleteFile, which allows an authenticated attacker with media management permissions to use ../ sequences to delete arbitrary files outside the intended media storage...
Grav CMS vulnerable to remote code execution via .zip file upload
Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...
EUVD-2026-58633
Grav CMS vulnerable to remote code execution via .zip file upload...
GHSA-R94F-HX44-8JQF Grav CMS vulnerable to remote code execution via .zip file upload
Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...
EUVD-2026-60601
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin...
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...
GHSA-XHFV-7758-R9HX Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...
EUVD-2026-60598
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss, bypassing the page-content XSS safety gate...
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...
GHSA-Q2J8-X8HF-63CH Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...
EUVD-2026-60591
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...
GHSA-VFMF-Q6X9-CW96 Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...
EUVD-2026-60592
Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...
GHSA-4V9Q-P283-QC2M Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...