CVE-2021-29440

Grav CMS 1.7.x is affected by CVE-2021-29440 due to unsandboxed Twig processing of static pages enabled via front matter by users with page-creation/admin privileges. The vulnerability enables server-side template injection, which can lead to arbitrary code execution and privilege escalation on t...

CVE-2025-66299

Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that lets an authenticated editor execute arbitrary code on the server by abusing the Twig sandbox, bypassing restrictions via crafted Twig directives to modify system.twig.safe_filters. The issue exists prior to Grav 1.8.0-beta.27...

CVE-2022-2073

CVE-2022-2073 is a Grav SSTI vulnerability in getgrav/grav prior to 1.7.34 where the Twig filter function could be abused to trigger unsafe calls. Grav patched filter() in 1.7.34, but attackers could still abuse other Twig core filters (e.g., map/reduce) to reach remote code execution unless thos...

CVE-2024-28116

Grav CMS is vulnerable to Server-Side Template Injection (SSTI) in versions prior to 1.7.45. An authenticated editor can trigger arbitrary code execution on the server by injecting crafted Twig template directives, bypassing the sandbox. The issue arises from insufficient sandboxing/validation of...

CVE-2020-11529

Grav before 1.7 has an open redirect in Common/Grav.php. The issue is partially fixed in 1.6.23 but remains in 1.6.x; Grav 1.7+ is affected by the resolved behavior. Nuclei and Veracode entries describe the risk as open redirect that can redirect users to a malicious site (phishing). Practical im...

CVE-2022-0743

Summary: CVE-2022-0743 is a stored XSS vulnerability in the Grav CMS (GitHub repo getgrav/grav) affecting versions prior to 1.7.31. The issue arises from insufficient input validation/output handling that allows injected scripts to be stored and later executed by users. Public references (NVD, Re...

CVE-2022-0970

CVE-2022-0970 concerns Grav CMS (getgrav/grav). The vulnerability is a stored cross-site scripting issue in Grav prior to 1.7.31 caused by lack of proper data validation/filtering of user-supplied data and output, enabling JavaScript execution on the client side. The available connected documenta...

CVE-2021-3818

CVE-2021-3818 : Grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. The connected sources confirm the issue stems from Grav’s handling of cookies without proper validation and integrity checks, with a documented risk example noting that a cookie with an overly bro...

CVE-2022-1173

CVE-2022-1173 affects Grav CMS: stored XSS in getgrav/grav prior to 1.7.33 due to insufficient input filtering/escaping. Impact is client-side JavaScript execution. No exploitation details are provided in the public documents beyond the vulnerability description. Remediation: upgrade Grav to 1.7....

CVE-2024-27921

CVE-2024-27921 affects Grav CMS prior to 1.7.45. The vulnerability is a file upload path traversal in Grav’s media handling (MediaUploadTrait.php), allowing an attacker to replace or create files with extensions such as .json, .zip, .css, .gif, etc. The underlying risk includes arbitrary code exe...

CVE-2021-3904

CVE-2021-3904 affects Grav (getgrav/grav) and is a Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. Multiple sources (including GHSA, Red Hat, NVD, OSV, and CVE CVELIST entries) describe it as XSS with Grav versions prior to 1.7.24 being affec...

CVE-2024-27923

CVE-2024-27923 affects Grav CMS prior to 1.7.43. The issue arises from insufficient permission validation and inadequate filename validation in the Frontmatter feature, enabling a regular page writer to inject a malicious Frontmatter that can lead to Remote Code Execution (RCE). The vulnerability...

CVE-2023-34448

CVE-2023-34448 (Grav CMS) is a follow-up to CVE-2022-2073. Grav before v1.7.42 allowed remote code execution via Twig default filters (map and reduce) through unsafe callable arguments, because Grav’s patch for filter() only blocked certain calls on string arrows. The public patch/update in Grav ...

CVE-2024-34082

Grav (pre-1.7.46) contains a vulnerability where a low-privilege user with page edit rights can read server files using Twig syntax, including Grav user account files under /grav/user/accounts/*.yaml, which store password hashes, 2FA secrets, and password reset tokens. This enables potential acco...

CVE-2024-28118

Grav (open-source flat-file CMS) -- Affects versions prior to 1.7.45. Unrestricted access to the Twig extension class from the Grav context allows an attacker to redefine configuration variables, bypass a prior SSTI mitigation, and enable Twig processing of static pages by an admin. Since the Twi...

CVE-2021-3924

CVE-2021-3924 affects Grav (getgrav/grav) and is caused by an improper limitation of a pathname to a restricted directory (path traversal). The vulnerability is in the path handling logic of Grav, allowing access to files or directories outside the intended scope. Multiple connected sources confi...

CVE-2024-28119

CVE-2024-28119 — Grav vulnerable to SSTI via Twig escape handler . Grav (open-source flat-file CMS) prior to 1.7.45 allows an attacker to redefine the Twig escape function through unrestricted access to the twig extension class from the Grav context, enabling arbitrary command execution and privi...

CVE-2025-50286

Grav CMS v1.7.48 is affected by an authenticated RCE via the Admin Panel’s /admin/tools/direct-install feature. An authenticated administrator can upload a malicious plugin (e.g., ZIP with arbitrary PHP) that is extracted and loaded, enabling arbitrary PHP code execution and a reverse shell. The ...

CVE-2023-34253

CVE-2023-34253 concerns Grav CMS before v1.7.42, where a weakened denylist for dangerous Twig functions allows a logged‑in admin with page creation/update rights (or a user with Admin login) to inject templates and achieve remote code execution. The vulnerability stems from multiple bypass pathwa...

CVE-2024-28117

Grav (CVE-2024-28117) is vulnerable to Server-Side Template Injection due to improper validation of accessible functions: Utils::isDangerousFunction checks are bypassed for twig_array_map, allowing an attacker to execute arbitrary commands via the Twig processor when static pages are processed. A...

CVE-2023-34251

Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...

CVE-2023-34252

CVE-2023-34252 — Grav SSTI (GravExtension.filterFilter) grav CMS versions prior to 1.7.42 contain a logic flaw in GravExtension.filterFilter() where unsafe-function validation runs only for string arrows; passing an array as a callable bypasses the check, enabling authenticated admin users with p...

CVE-2023-31506

CVE-2023-31506 : Grav CMS versions 1.7.44 and earlier are vulnerable to an XSS issue where an authenticated remote attacker can inject arbitrary web scripts/HTML via the onmouseover attribute on an ISINDEX element. The public documents consistently describe the vulnerable component (Grav), the ve...

CVE-2022-0268

CVE-2022-0268 is an XSS vulnerability in Grav prior to 1.7.28, stored in Packagist getgrav/grav. Root cause: insufficient input validation/escaping allows a low-privilege user to inject arbitrary JavaScript when creating a page. Affects Grav versions

CVE-2024-35498

CVE-2024-35498 targets Grav CMS v1.7.45 with a cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected component: Grav CMS ( Grav v1.7.45 ); vulnerability type: XSS. Impact is limited to web scripting/HTML execution...

CVE-2023-34452

Grav CMS (flat‑file)

CVE-2023-37897

Grav SSTI CVE-2023-37897 affects Grav’s Twig engine due to a denial-list bypass introduced in the fix for a prior SSTI vulnerability. The isDangerousFunction() function returns false when a backslash is found, allowing payloads such as {{ ['id'] | map('\system') | join() }} to bypass the denylist...

CVE-2026-42844

Grav 2.0.0-beta.2 contains an authenticated API privilege-escalation in the blueprint-upload flow. A low-privileged API user (api.media.write) can write an arbitrary YAML file into user/accounts/ via /api/v1/blueprint-upload, then log in as the created account with api.super, resulting in full ad...

CVE-2026-42611

Grav CVE-2026-42611 is a stored XSS in Grav Core + Admin Plugin (versions around v1.7.49.5 / v1.10.49.1) that a low-privileged user can exploit via page content to exfiltrate admin context, including the admin nonce, potentially bypass CSRF protections and enable further actions on sensitive admi...

CVE-2025-66294

CVE-2025-66294 affects Grav CMS. A Server-Side Template Injection (SSTI) exists due to weak regex validation in the core method cleanDangerousTwig, enabling an authenticated editor to trigger arbitrary commands on the server; in some cases, unauthenticated exploitation is possible. Public materia...

CVE-2025-46198

CVE-2025-46198 affects Grav CMS versions 1.7.46–1.7.48. The vulnerability is a Cross-Site Scripting flaw that allows an attacker to execute arbitrary code through the onerror attribute of the img element. Root cause is an unvalidated onerror attribute, enabling script execution in contexts honori...

CVE-2026-42610

Grav CMS vulnerability CVE-2026-42610: A low-privilege user can bypass Twig sandbox via grav['accounts'] to load administrative user objects and extract sensitive data (e.g., bcrypt password hashes and the security salt). This information disclosure affects Grav before 2.0.0-beta.2. The issue is ...

CVE-2026-42612

Grav: Publisher-level stored XSS in getgrav/grav due to a flawed blacklist in detectXss() that mishandles unquoted HTML event attributes. This allows arbitrary JavaScript execution via crafted content prior to 2.0.0-beta.2. The issue is fixed in Grav core on the 2.0 branch; upgrade to 2.0.0-beta....

CVE-2026-44738

Technical details are not publicly available in the provided documents. Monitor for updates from authoritative sources for affected software, version, and remediation.

CVE-2025-66295

Grav CVE-2025-66295 describes a path traversal/write vulnerability in Grav’s Admin UI: before 1.8.0-beta.27, a user-creation flow could cause an account YAML file to be written outside the intended user/accounts/ directory when the username contains traversal sequences (e.g., ../../Nijat). The wr...

CVE-2025-66304

Grav (file-based Web platform) exposes password hashes to users with read access in the admin panel’s user-account management, enabling potential privilege escalation if hashes are cracked. The issue affects Grav prior to 1.8.0-beta.27 and is fixed in 1.8.0-beta.27, per CVE-2025-66304 sources (NV...

CVE-2026-42609

Grav CVE-2026-42609 describes a business-logic flaw in the Grav Admin Panel where a low-privileged user with admin user-creation permissions can overwrite a higher-privilege account by creating a new user with an existing username. The system incorrectly updates the existing account’s metadata an...

CVE-2025-66296

CVE-2025-66296 affects Grav (file-based CMS). Before 1.8.0-beta.27, the Admin plugin has a flaw: no username uniqueness validation when creating users. An account with create user permissions can register a new user using an existing admin username, set a new password/email, and then log in as th...

CVE-2025-66297

CVE-2025-66297 concerns Grav CMS prior to 1.8.0-beta.27. A user with admin-panel access and permissions to create/edit pages can enable Twig in page frontmatter, inject malicious Twig expressions, and escalate to admin or trigger arbitrary system commands via the scheduler API. Reported impacts i...

CVE-2025-66843

Grav, prior to v1.7.49.5, is affected by a Stored XSS in the page editing feature. An authenticated, low-privilege user with edit permissions can inject JavaScript into editable fields; the payload is stored server-side and executed when other users view or edit the affected page. Affected versio...

CVE-2025-46199

The CVE-2025-46199 entry concerns Grav CMS. Affected software: Grav prior to version 1.7.49. Issue: Cross-Site Scripting via crafted scripts in form fields due to insufficient input validation. Impact described as arbitrary code execution with high severity (per the initial data: CVSS 3.1 vector ...

CVE-2025-66301

Grav CMS contains a broken access control vulnerability (CVE-2025-66301) where an editor with only basic content permissions can modify the YAML frontmatter data[_json][header][form] in POST to /admin/pages/{page_name}, altering the form processing logic. Root cause: improper authorization checks...

CVE-2025-66302

Grav CMS path traversal vulnerability (CVE-2025-66302) exists prior to 1.8.0-beta.27 in the backup tool’s input sanitization, enabling authenticated administrators to read arbitrary files on the server filesystem outside the webroot. Impact depends on the privileges of the Grav process account; f...

CVE-2021-47812

GravCMS 1.10.7 is affected by CVE-2021-47812, with an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code via the scheduler endpoint. Exploitation centers on the admin-nonce parameter to inject base64-encoded payloads and create ma...

CVE-2020-37256

Grav before 1.6.30 has a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access. Affected product is G...

CVE-2025-66306

CVE-2025-66306 describes an Insecure Direct Object Reference (IDOR) in Grav CMS Admin Panel prior to 1.8.0-beta.27. The vulnerability allows low-privilege authenticated users to access information from other accounts via endpoints such as /admin/accounts/users/{username}, potentially exposing adm...

CVE-2025-66298

Grav is a file-based CMS affected by a server‑side template injection (SSTI) via forms. A crafted POST can disclose the entire Grav configuration, including plugin settings, exposing sensitive information. This vulnerability exists in Grav prior to 1.8.0-beta.27 and is fixed in 1.8.0-beta.27. Rem...

CVE-2025-66300

Grav is a file-based CMS affected by CVE-2025-66300. A low-privilege user with page-editing rights could exploit path traversal via the Frontmatter form to read server files, including Grav user accounts located at /grav/user/accounts/*.yaml, exposing password hashes, 2FA secrets, and password-re...

CVE-2026-42841

Grav CMS stores image attributes via Markdown media action parameters. Before 2.0.0-beta.2, an authenticated page editor could inject a JavaScript event handler by calling attribute(name, value) through image query parameters (e.g., ?attribute=onload,alert(...)). The attack results in a stored XS...

CVE-2025-66303

Grav vulnerability CVE-2025-66303: In Grav prior to 1.8.0-beta.27, the admin panel can enter malformed cron-like input in the scheduled_at parameter, e.g., a single quote, causing DoS by corrupting backup.yaml. The issue stems from insufficient sanitization of cron expressions. Recovery requires ...