Directory Traversal

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Directory Traversal via the plugin-asset-map.php process. An attacker can access files outside the intended directory by crafting requests tha...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the errorlog function. An attacker can write arbitrary PHP code to web-accessible files by leveraging access to...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the detectXss function due to improper handling of unpaired quotes in unquoted attribute values, which allows even...

Improper Privilege Management

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Privilege Management in the access field of the core group blueprint. An attacker can gain elevated privileges by saving a group with...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the sourceParsedownElement process. An attacker can execute arbitrary HTML and JavaScript in the context of anoth...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Security::detectXss function. An attacker can inject malicious JavaScript into page content by including an...

Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media <source> URL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6qw9-4vv5-jr97. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering throug...

Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfmf-q6x9-cw96. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quot...

Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q2j8-x8hf-63ch. This link is maintained to preserve external references. Original Description Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function...

Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhfv-7758-r9hx. This link is maintained to preserve external references. Original Description Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.sup...

Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...

Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses stri...

CVE-2026-75831

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that...

CVE-2026-75832

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75837

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...

CVE-2026-75836

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...