getgrav vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__cHigh 8.7 · Oct 27, 2026
• CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ diHigh 8.7 · Oct 24, 2026
• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary FHigh 7 · Oct 21, 2026
• CVE-2026-114659 Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-levHigh 7.1 · Oct 21, 2026
• CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super userHigh 8.7 · Oct 21, 2026
• CVE-2026-112782 Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.High 8.7 · Oct 19, 2026
• CVE-2026-112781 Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ direcHigh 8.7 · Oct 19, 2026
• CVE-2026-112780 Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form Critical 9.3 · Oct 19, 2026
• CVE-2026-112779 Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET Critical 9.3 · Oct 19, 2026
• CVE-2026-109326 Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document High 8.7 · Oct 12, 2026
• CVE-2026-109325 Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values.High 8.7 · Oct 12, 2026
• CVE-2026-109324 Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster High 7.1 · Oct 12, 2026
• CVE-2026-109321 Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username anCritical 9.3 · Oct 12, 2026
• CVE-2026-109317 Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing posHigh 8.6 · Oct 12, 2026
• CVE-2026-109315 Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandboxHigh 7.1 · Oct 12, 2026
• CVE-2026-109314 Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a pageHigh 8.5 · Oct 12, 2026
• CVE-2026-109313 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authenticatiHigh 8.6 · Oct 12, 2026
• CVE-2026-109312 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pendingHigh 8.6 · Oct 12, 2026
• CVE-2026-100673 The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/High 8.4 · Sep 26, 2026
• CVE-2026-100672 The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any High 8.7 · Sep 26, 2026
• CVE-2026-100671 Grav is a flat-file CMS.High 8.6 · Sep 26, 2026
• CVE-2026-100670 Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints.High 8.7 · Sep 26, 2026
• CVE-2026-100669 Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively.High 8.7 · Sep 26, 2026
• CVE-2026-100668 Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape.High 7.1 · Sep 26, 2026
• CVE-2026-92917 Grav is a flat-file CMS.High 8.7 · Sep 17, 2026