CVE-2021-29440

Grav CMS 1.7.x is affected by CVE-2021-29440 due to unsandboxed Twig processing of static pages enabled via front matter by users with page-creation/admin privileges. The vulnerability enables server-side template injection, which can lead to arbitrary code execution and privilege escalation on t...

CVE-2025-66299

Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that lets an authenticated editor execute arbitrary code on the server by abusing the Twig sandbox, bypassing restrictions via crafted Twig directives to modify system.twig.safe_filters. The issue exists prior to Grav 1.8.0-beta.27...

CVE-2022-2073

CVE-2022-2073 is a Grav SSTI vulnerability in getgrav/grav prior to 1.7.34 where the Twig filter function could be abused to trigger unsafe calls. Grav patched filter() in 1.7.34, but attackers could still abuse other Twig core filters (e.g., map/reduce) to reach remote code execution unless thos...

CVE-2024-28116

Grav CMS is vulnerable to Server-Side Template Injection (SSTI) in versions prior to 1.7.45. An authenticated editor can trigger arbitrary code execution on the server by injecting crafted Twig template directives, bypassing the sandbox. The issue arises from insufficient sandboxing/validation of...

CVE-2022-0743

Summary: CVE-2022-0743 is a stored XSS vulnerability in the Grav CMS (GitHub repo getgrav/grav) affecting versions prior to 1.7.31. The issue arises from insufficient input validation/output handling that allows injected scripts to be stored and later executed by users. Public references (NVD, Re...

CVE-2022-0970

CVE-2022-0970 concerns Grav CMS (getgrav/grav). The vulnerability is a stored cross-site scripting issue in Grav prior to 1.7.31 caused by lack of proper data validation/filtering of user-supplied data and output, enabling JavaScript execution on the client side. The available connected documenta...

CVE-2021-3818

CVE-2021-3818 : Grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. The connected sources confirm the issue stems from Grav’s handling of cookies without proper validation and integrity checks, with a documented risk example noting that a cookie with an overly bro...

CVE-2022-1173

CVE-2022-1173 affects Grav CMS: stored XSS in getgrav/grav prior to 1.7.33 due to insufficient input filtering/escaping. Impact is client-side JavaScript execution. No exploitation details are provided in the public documents beyond the vulnerability description. Remediation: upgrade Grav to 1.7....

CVE-2024-27921

CVE-2024-27921 affects Grav CMS prior to 1.7.45. The vulnerability is a file upload path traversal in Grav’s media handling (MediaUploadTrait.php), allowing an attacker to replace or create files with extensions such as .json, .zip, .css, .gif, etc. The underlying risk includes arbitrary code exe...

CVE-2021-3904

CVE-2021-3904 affects Grav (getgrav/grav) and is a Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. Multiple sources (including GHSA, Red Hat, NVD, OSV, and CVE CVELIST entries) describe it as XSS with Grav versions prior to 1.7.24 being affec...

CVE-2024-27923

CVE-2024-27923 affects Grav CMS prior to 1.7.43. The issue arises from insufficient permission validation and inadequate filename validation in the Frontmatter feature, enabling a regular page writer to inject a malicious Frontmatter that can lead to Remote Code Execution (RCE). The vulnerability...

CVE-2023-34448

CVE-2023-34448 (Grav CMS) is a follow-up to CVE-2022-2073. Grav before v1.7.42 allowed remote code execution via Twig default filters (map and reduce) through unsafe callable arguments, because Grav’s patch for filter() only blocked certain calls on string arrows. The public patch/update in Grav ...

CVE-2024-34082

Grav (pre-1.7.46) contains a vulnerability where a low-privilege user with page edit rights can read server files using Twig syntax, including Grav user account files under /grav/user/accounts/*.yaml, which store password hashes, 2FA secrets, and password reset tokens. This enables potential acco...

CVE-2024-28118

Grav (open-source flat-file CMS) -- Affects versions prior to 1.7.45. Unrestricted access to the Twig extension class from the Grav context allows an attacker to redefine configuration variables, bypass a prior SSTI mitigation, and enable Twig processing of static pages by an admin. Since the Twi...

CVE-2023-34253

CVE-2023-34253 concerns Grav CMS before v1.7.42, where a weakened denylist for dangerous Twig functions allows a logged‑in admin with page creation/update rights (or a user with Admin login) to inject templates and achieve remote code execution. The vulnerability stems from multiple bypass pathwa...

CVE-2024-28119

CVE-2024-28119 — Grav vulnerable to SSTI via Twig escape handler . Grav (open-source flat-file CMS) prior to 1.7.45 allows an attacker to redefine the Twig escape function through unrestricted access to the twig extension class from the Grav context, enabling arbitrary command execution and privi...

CVE-2024-28117

Grav (CVE-2024-28117) is vulnerable to Server-Side Template Injection due to improper validation of accessible functions: Utils::isDangerousFunction checks are bypassed for twig_array_map, allowing an attacker to execute arbitrary commands via the Twig processor when static pages are processed. A...

CVE-2023-34251

Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...

CVE-2023-34252

CVE-2023-34252 — Grav SSTI (GravExtension.filterFilter) grav CMS versions prior to 1.7.42 contain a logic flaw in GravExtension.filterFilter() where unsafe-function validation runs only for string arrows; passing an array as a callable bypasses the check, enabling authenticated admin users with p...

CVE-2022-0268

CVE-2022-0268 is an XSS vulnerability in Grav prior to 1.7.28, stored in Packagist getgrav/grav. Root cause: insufficient input validation/escaping allows a low-privilege user to inject arbitrary JavaScript when creating a page. Affects Grav versions

CVE-2026-44738

Technical details are not publicly available in the provided documents. Monitor for updates from authoritative sources for affected software, version, and remediation.

CVE-2025-66297

CVE-2025-66297 concerns Grav CMS prior to 1.8.0-beta.27. A user with admin-panel access and permissions to create/edit pages can enable Twig in page frontmatter, inject malicious Twig expressions, and escalate to admin or trigger arbitrary system commands via the scheduler API. Reported impacts i...

CVE-2025-66843

Grav, prior to v1.7.49.5, is affected by a Stored XSS in the page editing feature. An authenticated, low-privilege user with edit permissions can inject JavaScript into editable fields; the payload is stored server-side and executed when other users view or edit the affected page. Affected versio...

CVE-2025-66302

Grav CMS path traversal vulnerability (CVE-2025-66302) exists prior to 1.8.0-beta.27 in the backup tool’s input sanitization, enabling authenticated administrators to read arbitrary files on the server filesystem outside the webroot. Impact depends on the privileges of the Grav process account; f...

CVE-2025-66301

Grav CMS contains a broken access control vulnerability (CVE-2025-66301) where an editor with only basic content permissions can modify the YAML frontmatter data[_json][header][form] in POST to /admin/pages/{page_name}, altering the form processing logic. Root cause: improper authorization checks...

CVE-2020-37256

Grav before 1.6.30 has a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access. Affected product is G...

CVE-2025-66298

Grav is a file-based CMS affected by a server‑side template injection (SSTI) via forms. A crafted POST can disclose the entire Grav configuration, including plugin settings, exposing sensitive information. This vulnerability exists in Grav prior to 1.8.0-beta.27 and is fixed in 1.8.0-beta.27. Rem...

CVE-2025-66300

Grav is a file-based CMS affected by CVE-2025-66300. A low-privilege user with page-editing rights could exploit path traversal via the Frontmatter form to read server files, including Grav user accounts located at /grav/user/accounts/*.yaml, exposing password hashes, 2FA secrets, and password-re...

CVE-2025-66303

Grav vulnerability CVE-2025-66303: In Grav prior to 1.8.0-beta.27, the admin panel can enter malformed cron-like input in the scheduled_at parameter, e.g., a single quote, causing DoS by corrupting backup.yaml. The issue stems from insufficient sanitization of cron expressions. Recovery requires ...

CVE-2025-66844

CVE-2025-66844 affects Grav up to version

CVE-2026-29924

CVE-2026-29924 – Grav CMS v1.7.x and earlier is vulnerable to XML External Entity (XXE) when uploading SVG files via the admin panel or File Manager plugin. The issue arises from external entity processing in SVG/XML input, enabling access to local or sensitive resources in affected environments ...

CVE-2026-42608

Grav CVE-2026-42608 describes an unauthenticated path traversal in the FormFlash component that lets an attacker manipulate the session_id (__form-flash-id) in POST requests to traverse the filesystem and write an index.yaml, enabling arbitrary directory creation and data manipulation. Affected: ...