CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-61842 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...

CVE-2026-61842

Grav (file-based web platform) versions prior to 2.0.2 contain a Twig sandbox bypass in the content rendering pipeline. The sandbox replaces the config variable with a redacted facade and strips Config::get/toArray from the method allowlist, but the raw configuration container remains accessible ...

CVE-2026-61842 Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...

CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...

CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...

CVE-2026-61690

Grav's ZipArchiver::extract() calls ZipArchive::extractTo() without enforcing configured archive limits (uncompressed-size, file-count, nesting-depth). A low-privilege network attacker can submit a decompression bomb archive to exhaust disk space or inodes, causing denial of service. Fixed in Gra...

CVE-2026-61607

In Grav API plugin versions prior to 1.0.2, HandlesMediaUploads::processUploadedFile() validates only the SVG filename extension without calling Security::sanitizeSVG(), allowing an attacker with api.media.write permission to upload an SVG with embedded JavaScript. The server serves it as Content...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

EUVD-2026-62533

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

CVE-2026-61607 Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

EUVD-2026-62532

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

CVE-2026-53654

CVE-2026-53654 affects the Grav file-based web platform's Login plugin (prior to 3.8.5 ). The twofa_cancel task accepts a client-controlled _redirect field without a nonce, allowing an unauthenticated attacker to set an external http, https, or protocol-relative Location target. The root cause li...

CVE-2026-53654 Grav: Unauthenticated open redirect via login twofa_cancel _redirect

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...

PT-2026-78484

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.2 Description The Grav Twig content sandbox allows the use of grav.offsetGet'config' to return the raw configuration object. Additionally, it permits the use of json encode, print r, yaml encode, and string filters t...

PT-2026-78517

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.7 Description In the Blueprint::dynamicData function located in system/src/Grav/Common/Data/Blueprint.php, the software passes an editor-controlled Class::method provider and arguments to call user func array without...

PT-2026-78483

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.1 Description The ZipArchiver::extract function in system/src/Grav/Common/Filesystem/ZipArchiver.php fails to enforce limits on uncompressed size, file count, or nesting depth when passing archives to...

PT-2026-78482

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.2 Description The plugin fails to invoke the Security::sanitizeSVG function within the HandlesMediaUploads::processUploadedFile function when processing the 'POST /api/v1/media' endpoint. While the SVG...

PT-2026-78488

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Grav allows the regex replace filter and function in system/config/security.yaml. The GravExtension::regexReplace function passes a pattern controlled by the editor directly to preg replace. When...