getgrav vulnerabilities

Products

• getgrav/grav 195
• grav-plugin-api 18
• grav-plugin-admin 11
• getgrav/grav 8
• grav-plugin-login 7
• grav cms 5
• grav-plugin-form 5
• getgrav/grav-plugin-admin 2
• grav-plugin-flex-objects 2
• grav-plugin-guestbook 2
• grav-plugin-shortcode-core 2
• dom-sanitizer 1
• grav admin 1
• Grav CMS Admin Plugin 1
• grav-plugin-admin2 1
• grav-plugin-comments 1
• grav-plugin-data-manager 1
• grav-plugin-datamanager 1
• grav-plugin-login-oauth 1
• grav-plugin-star-ratings 1
• GravCMS 1

Latest getgrav CVEs

Newest publication first · page 1 of 10

1. CVE-2026-124434 Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

   Published 2026-11-08

   High·CVSS 7.1 EPSS 0.30%

   Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML fil...

2. CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

   Published 2026-10-27

   High·CVSS 8.7 EPSS 0.31%

   Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as...

3. CVE-2026-116019 Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

   Published 2026-10-24

   High·CVSS 8.7 EPSS 0.35%

   Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form ove...

4. CVE-2026-114659 Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

   Published 2026-10-22

   High·CVSS 7.1 EPSS 0.63%

   Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions...

5. CVE-2026-114660 Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives

   Published 2026-10-22

   High·CVSS 7.0 EPSS 0.21%

   Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directi...

6. CVE-2026-114658 Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

   Published 2026-10-22

   High·CVSS 8.7 EPSS 0.26%

   Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated,...

7. CVE-2026-114657 Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

   Published 2026-10-22

   Medium·CVSS 6.9 EPSS 0.22%

   Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline sty...

8. CVE-2026-112782 Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

   Published 2026-10-19

   High·CVSS 8.7 EPSS 0.76%

   Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResiz...

9. CVE-2026-112781 Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

   Published 2026-10-19

   High·CVSS 8.7 EPSS 0.62%

   Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths red...

10. CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

    Published 2026-10-19

    Critical·CVSS 9.3 EPSS 0.72%

    Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to...

11. CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

    Published 2026-10-19

    Critical·CVSS 9.3 EPSS 0.76%

    Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the s...

12. CVE-2026-109326 Grav before 2.1.7 Information Disclosure via Nested .git Directories

    Published 2026-10-12

    High·CVSS 8.7 EPSS 0.35%

    Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and obje...

13. CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

    Published 2026-10-12

    High·CVSS 8.7 EPSS 0.40%

    Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, re...

14. CVE-2026-109324 Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

    Published 2026-10-12

    High·CVSS 7.1 EPSS 0.32%

    Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension...

15. CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

    Published 2026-10-12

    Medium·CVSS 6.9 EPSS 0.26%

    Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted by getData() to submit votes directly to...

16. CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

    Published 2026-10-12

    Medium·CVSS 5.3 EPSS 0.20%

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that execut...

17. CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

    Published 2026-10-12

    Critical·CVSS 9.3 EPSS 0.40%

    Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated rem...

18. CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

    Published 2026-10-12

    Medium·CVSS 5.3 EPSS 0.25%

    The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remem...

19. CVE-2026-109319 Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

    Published 2026-10-12

    Medium·CVSS 5.3 EPSS 0.20%

    Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator...

20. CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants

    Published 2026-10-12

    High·CVSS 8.6 EPSS 0.36%

    Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so t...

21. CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin

    Published 2026-10-12

    Medium·CVSS 6.9 EPSS 0.27%

    Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename...

22. CVE-2026-109315 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

    Published 2026-10-12

    High·CVSS 7.1 EPSS 0.30%

    Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger.token. Attackers can render the token through editor-authored Twig and supply it a...

23. CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

    Published 2026-10-12

    High·CVSS 8.5 EPSS 0.28%

    Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage...

24. CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie

    Published 2026-10-12

    High·CVSS 8.6 EPSS 0.35%

    Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step...

25. CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form

    Published 2026-10-12

    High·CVSS 8.6 EPSS 0.35%

    Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an ac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.