2165 matches found
GHSA-9CCQ-2JFG-QW33 Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Summary Grav\Common\Uri::referrer and Grav\Common\Page\Pages::referrerRoute both check whether an incoming request's Referer header "came from our site" using strstartswith$referrer, $base, where $base is the site's own absolute root URL for example https://example.com, no trailing slash. Because...
CVE-2026-62672
creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:26+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9...
GHSA-6QW9-4VV5-JR97 Grav: Stored XSS via Markdown audio/video media <source> URL
Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...
Grav: Stored XSS via Markdown audio/video media <source> URL
Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...
EUVD-2026-60595
Grav: Stored XSS via Markdown audio/video media URL...
GHSA-269C-H76Q-8CXW Grav: Stored XSS via quoted-attribute bypass in detectXss
Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...
Grav: Stored XSS via quoted-attribute bypass in detectXss
Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...
EUVD-2026-58646
Grav: Stored XSS via quoted-attribute bypass in detectXss...
EUVD-2026-52282
Grav: Path Traversal in ImageMedium::watermark — arbitrary file disclosure via publicly-cached images...
GHSA-W3F4-8PJ2-599W Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...
EUVD-2026-52281
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...
GHSA-7PGQ-CR25-XVC8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...
EUVD-2026-48244
Grav: FlexDirectory::dynamicDataField executes arbitrary callables from blueprint data with no validation...
GHSA-C4WF-2XXC-68QM Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Summary A missing validation check in Grav's Flex framework lets an account holding nothing but an ordinary object-create permission on a single Flex directory execute arbitrary shell commands on the server. Any authenticated user with create or update rights on a Flex-based directory Flex Users,...
CVE-2026-61841
creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:06+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-8h9x-89f2-m7x3...
GHSA-8H9X-89F2-M7X3 Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.maxuncompressedsize default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPM\Installer::unZip a...
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.maxuncompressedsize default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPM\Installer::unZip a...