Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 14 total.
Remote code execution in Grav CMS via unchecked callable in FlexDirectory (CVE-2026-65608)
A missing validation check in `FlexDirectory::dynamicDataField()` allows the method to resolve blueprint `data-*@:` directives by calling `call_user_func_array()` on attacker-influenced input, verifying only that the ...
Fixed in 2.0.9
Broken access control in Grav API Plugin configuration scopes (CVE-2026-65895)
The Grav API Plugin's ConfigController fails to restrict the `plugins/api` configuration scope to the `api.super` privilege, allowing authenticated users holding only `api.config.write` to modify the API plugin's own ...
Fixed in 1.0.10
Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)
The Grav API Plugin fails to properly sanitize the `slug` field in the `PagesController::move()` method, stripping only leading period characters via `ltrim()` while leaving `/` and `..` path segments unfiltered. An a...
Fixed in 1.0.10
Privilege escalation via unvalidated groups field in Grav API Plugin (CVE-2026-65897)
InvitationsController::create() in the Grav API Plugin applies super-admin flag stripping to the `access` field but performs no equivalent authority check on the `groups` field, accepting it verbatim from the request ...
Fixed in 1.0.10
Privilege Escalation via profile self-update in Grav Login plugin (CVE-2026-65603)
The Grav Login plugin versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler. Unlike the registration handler, it does not strip privilege fields ('groups','access') fr...
Fixed in 3.8.12
Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
Grav's Blueprint::dynamicData() passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. An authenticated account with the admin.pages or api.pages.write permi...
Fixed in 2.0.7
Missing authorization on API key generation in Grav API plugin (CVE-2026-65007)
The Grav api plugin (grav-plugin-api) fails to properly authorize API key generation and revocation requests. The plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks before Grav's account-management ACL ...
Fixed in 1.0.8
Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)
Grav's default .htaccess and reference webserver-configs/htaccess.txt contain rules blocking HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) that lack the [NC] (No Case) flag, rendering ext...
Fixed in 2.0.4
Authorization bypass in Grav API plugin (CVE-2026-62231)
The Grav API plugin (getgrav/grav-plugin-api) contains an authorization bypass in which API keys created with a restricted scopes array are never enforced by the ApiKeyAuthenticator class. The authenticator loads and ...
Fixed in 1.0.6
Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An atta...
Fixed in 2.0.4
Privilege escalation in Grav Plugin API (CVE-2026-62233)
grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit t...
Fixed in 1.0.6
Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme ...
Fixed in 2.0.4
JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)
The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the...
Fixed in 1.0.0-rc.16
Overly permissive CORS in Grav API plugin (CVE-2026-62387)
The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attack...
Fixed in 1.0.0-rc.16