EUVD-2026-58636

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

CVE-2026-72820

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from...

CVE-2026-72820 Grav 2.0.11 Path Traversal via Backup Profile Configuration

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from...

EUVD-2026-58635

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

EUVD-2026-58634

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from...

CVE-2026-72820

Grav prior to 2.0.13 is vulnerable to a backup profile path traversal issue. The root-path validation fails when a hard-coded deny-list is not applied, allowing attackers who have profile editor access to configure backup profiles with traversal paths that can archive or expose files from outside...

CVE-2026-72820 Grav 2.0.11 Path Traversal via Backup Profile Configuration

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from...

CVE-2026-72821 Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

CVE-2026-72821

Grav Form plugin (before v9.1.15) contains a stored XSS in radio and toggle field option labels rendered via Twig |raw. With form authoring permissions, an attacker can inject HTML/script into option labels that executes in the browsers of visitors and admins viewing the form. The issue is caused...

CVE-2026-72821

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of...

CVE-2026-72819

Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...

EUVD-2026-58633

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...

PT-2026-71990

Name of the Vulnerable Software and Affected Versions Grav Form plugin versions prior to 9.1.15 Description A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig |raw filter. This allows attackers with form authoring permissions to injec...

PT-2026-71995

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The getgrav/grav-plugin-api plugin fails to validate that the scopes of a newly created API key are a subset of the caller's scopes within the createApiKey function. The self-target...

PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

CVE-2026-11430 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...