Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...

EUVD-2026-60592

Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...

GHSA-4V9Q-P283-QC2M Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...

EUVD-2026-60588

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php...

EUVD-2026-65209

Grav: Path Traversal in MediaUploadTrait::deleteFile Allows Arbitrary File Deletion...

EUVD-2026-65211

Grav: mediadirectory Twig function allows filesystem path traversal and file content disclosure from sandboxed page content...

EUVD-2026-65219

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashedpassword and 2FA secrets via offsetGet...

EUVD-2026-65220

Grav: configdeniedpaths default list omits system, exposing real secrets e.g. system.cache.redis.password via the Twig sandbox when configaccess is enabled...

EUVD-2026-65212

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by configdeniedpaths...

EUVD-2026-65215

Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...

EUVD-2026-65216

Grav: Origin validation bypass in Uri::referrer and Pages::referrerRoute via unanchored prefix match...

EUVD-2026-60595

Grav: Stored XSS via Markdown audio/video media URL...

EUVD-2026-58646

Grav: Stored XSS via quoted-attribute bypass in detectXss...

EUVD-2026-52282

Grav: Path Traversal in ImageMedium::watermark — arbitrary file disclosure via publicly-cached images...

EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

EUVD-2026-48244

Grav: FlexDirectory::dynamicDataField executes arbitrary callables from blueprint data with no validation...

CVE-2026-61841

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:06+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-8h9x-89f2-m7x3...