Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 7 total.

Severity: All Critical High

Library: grav

CVE-2026-62230 HIGH CVSS 8.7 Verified Advisory Jul 17, 2026

Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)

Grav's default .htaccess and reference webserver-configs/htaccess.txt contain rules blocking HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) that lack the [NC] (No Case) flag, rendering ext...

Fixed in 2.0.4

Apple Microsoft Information Disclosure Docker

CVE-2026-62231 HIGH CVSS 8.6 Verified Advisory Jul 17, 2026

Authorization bypass in Grav API plugin (CVE-2026-62231)

The Grav API plugin (getgrav/grav-plugin-api) contains an authorization bypass in which API keys created with a restricted scopes array are never enforced by the ApiKeyAuthenticator class. The authenticator loads and ...

Fixed in 1.0.6

Authentication Bypass Grav

CVE-2026-62232 CRITICAL CVSS 9.1 Verified Advisory Jul 17, 2026

Two-factor authentication bypass in Grav CMS (CVE-2026-62232)

A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An atta...

Fixed in 2.0.4

CSRF Authentication Bypass Grav

CVE-2026-62233 HIGH CVSS 8.7 Verified Advisory Jul 17, 2026

Privilege escalation in Grav Plugin API (CVE-2026-62233)

grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit t...

Fixed in 1.0.6

Authentication Bypass Grav

CVE-2026-62234 HIGH CVSS 8.4 Verified Advisory Jul 17, 2026

Server-Side Request Forgery in Grav CMS (CVE-2026-62234)

Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme ...

Fixed in 2.0.4

SSRF Grav

CVE-2026-62386 HIGH CVSS 8.2 Verified Advisory Jul 17, 2026

JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)

The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the...

Fixed in 1.0.0-rc.16

Information Disclosure Grav

CVE-2026-62387 HIGH CVSS 7.1 Verified Advisory Jul 17, 2026

Overly permissive CORS in Grav API plugin (CVE-2026-62387)

The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attack...

Fixed in 1.0.0-rc.16

Information Disclosure Cors Misconfiguration Grav