PT-2026-35830

Name of the Vulnerable Software and Affected Versions Grav CMS versions 1.7.44 through 2.0.0-beta.1 Description An insecure deserialization issue exists in the Cache Value Handler component. The doGet function within the system/src/Grav/Framework/Cache/Adapter/FileCache.php file uses unserialize...

CVE-2026-42608

creationtimestamp| type| source ---|---|--- 2026-04-27 12:17:38+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-hmcx-ch82-3fv2 2026-05-28 12:55:11+00:00| seen| https://t.me/codebysec/10152...

CVE-2026-42610

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:45+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-3f29-pqwf-v4j4...

CVE-2026-42842

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:07+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f...

CVE-2026-42841

creationtimestamp| type| source ---|---|--- 2026-04-27 12:14:51+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr 2026-07-10 18:00:20+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqcq3rslpl25...

Grav CMS Authenticated Scanner

This Python script is a safe, read-only scanner designed to detect whether a target running Grav CMS with its Admin plugin may be vulnerable to CVE-2025-50286, based purely on version analysis...

📄 Grav CMS 1.7.49.5 Shell Upload

This script targets a Grav CMS administrative panel by first authenticating, then checking version information to estimate vulnerability exposure. If conditions are met, it generates a malicious PHP plugin containing a base64-encoded payload and uploads it as a ZIP package through the “direct...

grav-cms-filecache-object-injection

Grav CMS FileCache Object Injection Description The File...

Metasploit Wrap-Up 04/03/2026

Additional Adapters and More Modules This week, we added a whole new bunch of HTTP/HTTPS-based CMD payloads for X64 and X86 versions of Windows. The additional breadth of selectable payloads and delivery techniques allows users new options to tailor the attack workflow for their environment. This...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

📄 Grav CMS 1.7.49.5 Remote Code Execution

Grav CMS versions 1.7.49.5 and below with Admin Plugin versions 1.10.49.3 and below are vulnerable to an authenticated remote code execution vulnerability via the "Direct Install" feature in the administrative interface. An authenticated administrator can upload a crafted plugin archive containin...

EUVD-2026-17148

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

XML External Entity (XXE) Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SVG file upload functionality in the admin panel and File Manager plugin. An attacker can access...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

PT-2026-29094

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

Grav CMS 安全漏洞

Grav CMS is an open-source file-based content management system developed by Grav. Versions of Grav CMS such as v1.7.x and earlier contained security vulnerabilities, which were caused by XML external entity injections in the SVG file upload feature...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

CVE-2026-29924

Grav CMS v1.7.x and before is vulnerable to XML External Entity XXE through the SVG file upload functionality in the admin panel and File Manager plugin...

CVE-2026-29924

CVE-2026-29924 – Grav CMS v1.7.x and earlier is vulnerable to XML External Entity (XXE) when uploading SVG files via the admin panel or File Manager plugin. The issue arises from external entity processing in SVG/XML input, enabling access to local or sensitive resources in affected environments ...