Getgrav
Monthly
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
Denial of service in Grav CMS 2.0.1 lets a trusted package source or admin-level uploader bypass the newly added decompression-bomb size cap and exhaust disk space or inodes on the host. The 2.0.1 cap trusts the attacker-forgeable uncompressed size declared in each ZIP central-directory entry rather than the actual inflated stream, so a crafted archive declaring tiny sizes slips past the check while extraction writes the real, far larger payload. This is an incomplete fix for GHSA-928x-9mpw-8h56, corrected in 2.0.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 exposes a window.__GRAV_CONFIG__ JavaScript object on the /grav/admin SPA bootstrap page and its subroutes, leaking exact Grav and Admin2 version numbers, server URL, API prefix, admin base path, and runtime environment to any unauthenticated visitor. Reported by VulnCheck, the flaw lets remote unauthenticated attackers fingerprint a deployment and pre-select version-specific exploits with zero active reconnaissance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in grav-plugin-admin ≤ 1.10.52 allows an authenticated attacker holding admin.users permission to take over any Grav account - including the super administrator - by sending a single crafted POST request to the user-save endpoint with a data[password] field. The saveUser() method in AdminController.php verifies that the caller holds user-management rights but never compares the caller's privilege tier against the target account's, enabling silent super-admin password replacement. SSVC marks exploitation as poc-level with total technical impact; vendor-released patch is version 1.10.53.
SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.
Uncontrolled resource consumption in Grav flat-file CMS before 1.7.53 and 2.0.0-rc.8 lets a remote unauthenticated visitor crash or degrade a server by requesting on-the-fly image derivatives with absurdly large dimensions. Because Grav::fallbackUrl forwards URL query image actions such as forceResize straight to ImageMedium magic actions with no dimension or pixel ceiling, a single crafted request forces the server to allocate huge amounts of memory and CPU to build the derivative. No public exploit identified at time of analysis, but the attack is trivial and scriptable given the CVSS 4.0 VA:H, AV:N/AC:L/PR:N profile.
Denial of service in Grav CMS before 2.0.1 allows authenticated users to exhaust server storage by uploading a crafted ZIP archive (a decompression bomb) that the ZipArchiver::extract() routine expands without enforcing limits on uncompressed size, file count, or nesting depth. The CVSS 4.0 base score of 7.1 reflects a network-reachable, low-privilege flaw whose sole impact is high availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive configuration exfiltration in Grav CMS before 2.0.2 lets an authenticated page author bypass the Twig sandbox and read the full config tree, including plugin SMTP credentials, API keys, and database passwords. The flaw is an incomplete fix for the earlier GHSA-j274-39qw-32c9 sandbox escape: the redacted 'config' facade is still trivially bypassed through the allow-listed grav.offsetGet('config') call. No public exploit has been identified at time of analysis, though the bypass technique is fully described in the vendor advisory.
Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. CVSS 7.7 (High) with confirmed scope change reflects cross-tenant impact in multi-admin environments. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav CMS 2.0.0 through 2.2.4 lets page authors harvest visitors' HTTP Basic authentication credentials - including administrator usernames and passwords - by rendering the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, into page content such as an inline style background image that beacons the captured values to an external host. Exploitation is precondition-heavy: the site must actually be protected by HTTP Basic auth so those PHP variables are populated, the attacker must already hold a page-author account permitted to write raw Twig/HTML page content (PR:L), and a credential-bearing victim such as an administrator must actively view the authored page (UI:P) before their browser issues the outbound request. No public exploit code was identified at time of analysis, and the vendor addressed the flaw in Grav 2.2.5; the assessed severity is moderate (CVSS 4.0: 6.9; CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) rather than an unauthenticated remote compromise.
Grav Star Ratings plugin versions 2.0.1 through 2.0.3 allow unauthenticated visitors to submit votes on restricted or disabled ratings because the vote_access and readonly restrictions are enforced only in client-side code. Attackers can obtain the anonymous nonce that getData() already emits publicly and call addVote() directly, manipulating rating aggregates; the confirmed impact is limited to data integrity with no confidentiality or availability loss. No public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Disabled accounts in Grav API plugin versions before 1.0.36 can continue to access API endpoints because SessionAuthenticator fails to re-validate account state on subsequent requests. Affected are authenticated users who hold a still-valid browser session or remember-me token obtained prior to account disabling, allowing them to bypass operator revocation until the session expires. No public exploit identified at time of analysis, and exploitation requires a pre-existing valid session, limiting the risk to moderate severity.
Missing authorization and cross-site request forgery flaws in the Grav Guestbook plugin versions 0.5.0 and 0.5.1 allow an authenticated admin without the admin.guestbook permission, or an external site leveraging a logged-in moderator's session via nonce-less GET requests, to delete or approve guestbook entries. The impact is limited to the integrity of guestbook content, with no confidentiality or availability effect and no code execution. The CVSS 4.0 base score is 5.3, no public exploit code is identified in the provided intelligence, and the issue is not listed in CISA KEV.
Unauthenticated attackers can delete arbitrary files stored under the user/data/ directory in installations of the Grav Data Manager plugin versions 1.4.0 through 1.4.5 when the classic Admin integration is active. The vulnerability arises from missing authorization checks and absent CSRF nonce validation, enabling requests with a delete parameter and a known data type/filename to remove files such as form submissions. This moderate-severity flaw (CVSS 4.0 base score 6.9; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) has no public exploit identified at time of analysis, and exploitation is limited to integrity and availability impacts on existing data files.
A two-factor authentication bypass in the Grav Login plugin (grav-plugin-login) versions 3.8.7 through 3.9.6 allows a remote attacker who already knows a member's password to read content that the site gates behind the no-argument authenticated() Twig function, the group form authenticated(null, 'group'), or the [authenticated] shortcode, because Login::isAuthenticated() checked only the session flag showing the password step had succeeded rather than the flag showing login had fully completed. The flaw (CWE-304, missing critical step in authentication) does not grant a completed session: the attacker cannot reach pages protected by an access: rule, cannot act as the member, and cannot use the permission-based authenticated('some.permission') form, so impact is confined to disclosure of that gated content. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), though the vendor has released a fix in 3.9.7.
Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.
Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.
Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Configuration secret exposure in Grav (all versions prior to 2.0.2) allows authenticated page authors to exfiltrate sensitive plugin credentials - including SMTP passwords, API keys, and plugin database credentials - through a Twig sandbox bypass. The Grav container's offsetGet and __get methods were allow-listed, enabling page-authored Twig to obtain the raw Config object, while serialization filters (json_encode, print_r, yaml_encode, string) were not routed through GravSecurityPolicy::checkMethodAllowed, so the sandbox's member-access gate was never triggered. The vendor-released fix is confirmed in version 2.0.2; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holding api.media.write permission to upload a malicious SVG file whose embedded JavaScript executes in any victim's browser that opens the file. The upload pipeline in HandlesMediaUploads::processUploadedFile() checks the SVG filename extension but omits the Security::sanitizeSVG() call, so script content passes through unmodified and is later served as Content-Type: image/svg+xml, triggering browser-side execution. Successful exploitation enables session token theft and impersonation of the victim; no public exploit has been identified at time of analysis, and vendor-released patch version 1.0.2 is available.
Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.
Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
Scope cap bypass in the Grav API plugin before 1.0.13 allows a holder of a scoped API key issued on a super admin account to call unauthorized DemoController operations. The private requireSuper() method exits early after confirming isSuperAdmin(), never reaching requirePermission() where api_key_scopes enforcement occurs, making the scope restriction on that key inert for the baseline() and reset() endpoints. Impact is bounded to demo-engine control - forced demo resets or baseline captures - and is conditional on demo mode being actively configured with writable resources. No public exploit is identified at time of analysis.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.15 allows authenticated form authors to inject arbitrary HTML and JavaScript into radio and toggle field option labels, which then execute in the browsers of any visitor or administrator rendering that form. The root cause is Twig's |raw filter being applied to user-controlled label content, bypassing the template engine's automatic output encoding. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.1 accurately reflects the requirement for prior authentication with form-authoring privileges.
Path traversal in Grav CMS backup profile validation exposes arbitrary server files to authenticated users with profile editor privileges. All Grav versions before 2.0.13 fail to canonicalize or allowlist backup profile root paths, relying instead on an insufficient hard-coded deny-list, allowing traversal sequences such as '../../opt' to be accepted. An attacker holding a profile editor account can configure a malicious backup profile, trigger a backup job, and download an archive containing sensitive files from directories like /opt, /mnt, or /srv that reside entirely outside GRAV_ROOT. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.
ReDoS in Grav CMS's Twig sandbox allows an authenticated page editor to crash the web server process via a catastrophically backtracking PCRE pattern supplied to the `regex_replace` filter. Affected versions are all Grav releases prior to 2.0.4. Exploitation requires a non-default configuration (`security.twig_content.process_enabled: true`) and at least page-editor-level authentication, limiting blast radius to deployments that have deliberately unlocked Twig processing in page content. No public exploit code or CISA KEV listing has been identified at time of analysis.
CSRF in grav-plugin-login before 3.8.11 allows a remote unauthenticated attacker to rotate a logged-in victim's TOTP secret by luring them to an attacker-controlled page that performs a top-level GET navigation to the Grav site's regenerate2FASecret task endpoint. Because Grav dispatches frontend tasks via GET URI parameters and the default SameSite=Lax session cookie policy permits cross-origin top-level GET navigations to carry cookies, the victim's authenticator app is silently invalidated, forcing 2FA re-enrollment - though the attacker gains no account access. No public exploit has been identified at time of analysis; CVSS 4.0 score is 2.3, reflecting genuinely low severity.
Broken access control in Grav Flex-Objects before 1.4.3 permits authenticated users holding only the api.access permission to perform full CRUD operations on directories lacking explicit permission configurations via the admin-next REST API. The vulnerability bypasses intended authorization controls (CWE-862) because the REST API fails to enforce object-level permission checks when no explicit policy is defined for a directory. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 AT:P metric confirms exploitation depends on the target instance containing permission-less directories, which may be common in default or lightly configured deployments.
Remote code execution in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is achievable by authenticated API users holding the api.media.write permission via a double-extension file upload bypass. The HandlesMediaUploads::validateFileExtension() method uses PHP's pathinfo() to inspect only the final file extension, meaning a file named shell.php.jpg passes the dangerous-extension blocklist while retaining a .php segment that certain web server configurations will execute as PHP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and exploitation is low-complexity once permission prerequisites are met.
Stored cross-site scripting (XSS) in Grav CMS 2.0.0 allows authenticated attackers with page-write API permission to inject JavaScript payloads that execute in visitors' browsers. The vulnerability arises when Twig content processing is enabled, leveraging Twig's string concatenation operator to bypass the XSS validator. Patched in version 2.0.1; proof-of-concept code is available but no known active exploitation.
Insufficient session invalidation in the Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 renders stolen JWT access tokens permanently valid for up to one hour post-compromise. Because tokens are issued without a jti (JWT ID) claim, the server retains no mechanism to selectively revoke them - meaning logout events, password resets, new token issuance, and even account disablement are all ineffective at terminating an active attacker's session. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 vector (AV:N/AC:L/PR:N) reflects that any attacker already in possession of a token can trivially exploit this revocation gap over the network.
Disk exhaustion and crash vulnerability in Grav's Direct Install tool allows an authenticated admin.super user to upload a specially crafted ZIP archive that decompresses without bound, filling the server disk or crashing the process. Affecting all Grav releases prior to 2.0.0, the root cause is the Installer::unZip method invoking PHP's ZipArchive::extractTo with no enforced limits on uncompressed size, entry count, or directory depth - a classic zip bomb attack surface. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released fix is available in version 2.0.0.
DSN string injection in grav-plugin-database prior to version 1.2.0 allows an administrator with Grav CMS plugin configuration access to manipulate PDO database connection strings by injecting unsanitized YAML field values. The vulnerable `Database::__call` method concatenates fields such as host, dbname, charset, server, database, directory, and filename directly into DSN strings without validation, enabling DSN attribute injection or path traversal to redirect database connections to unintended targets. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 1.2.0.
Stored XSS in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.3 allows an authenticated attacker holding the api.media.write permission to upload a malicious SVG file that executes arbitrary JavaScript in an administrator's browser session. The POST /api/v1/media endpoint's HandlesMediaUploads::processUploadedFile() method validates only the file extension and never calls Security::sanitizeSVG(), so the uploaded file is stored and served verbatim with Content-Type: image/svg+xml. When an administrator opens the file directly or via an embedded object or iframe, the injected script runs in the admin's authenticated session context, enabling cookie theft and full session hijacking. No public exploit or active exploitation has been identified at time of analysis.
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full server compromise through admin account creation or code execution.
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make the server issue arbitrary HTTP requests, but only when page content is processed through Twig templates and the configuration permits registration of undefined PHP functions. Public exploit code exists, though EPSS is low (0.29%) and no active exploitation has been confirmed in CISA KEV. The independent assessment notes that signals conflict and should be weighed carefully, rating the vulnerability as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting the significant non-default prerequisites.
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. This vulnerability is fixed in 1.11.0-beta.1.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.
A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted-such as a single forward slash (/) or an XSS test string-it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the preg_match() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes non-functional, causing significant disruptions to administrative operations. The only way to recover from this issue is to manually access the host server and modify the backup.yaml file to correct the corrupted cron expression. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory. The impact of this vulnerability depends on the privileges of the user account running the application. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password. This vulnerability is fixed in 1.8.0-beta.27.
Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a content management system (CMS). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Grav is a file-based Web-platform built in PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository getgrav/grav prior to 1.7.34. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
stored xss in GitHub repository getgrav/grav prior to 1.7.33. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
Denial of service in Grav CMS 2.0.1 lets a trusted package source or admin-level uploader bypass the newly added decompression-bomb size cap and exhaust disk space or inodes on the host. The 2.0.1 cap trusts the attacker-forgeable uncompressed size declared in each ZIP central-directory entry rather than the actual inflated stream, so a crafted archive declaring tiny sizes slips past the check while extraction writes the real, far larger payload. This is an incomplete fix for GHSA-928x-9mpw-8h56, corrected in 2.0.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 exposes a window.__GRAV_CONFIG__ JavaScript object on the /grav/admin SPA bootstrap page and its subroutes, leaking exact Grav and Admin2 version numbers, server URL, API prefix, admin base path, and runtime environment to any unauthenticated visitor. Reported by VulnCheck, the flaw lets remote unauthenticated attackers fingerprint a deployment and pre-select version-specific exploits with zero active reconnaissance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in grav-plugin-admin ≤ 1.10.52 allows an authenticated attacker holding admin.users permission to take over any Grav account - including the super administrator - by sending a single crafted POST request to the user-save endpoint with a data[password] field. The saveUser() method in AdminController.php verifies that the caller holds user-management rights but never compares the caller's privilege tier against the target account's, enabling silent super-admin password replacement. SSVC marks exploitation as poc-level with total technical impact; vendor-released patch is version 1.10.53.
SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.
Uncontrolled resource consumption in Grav flat-file CMS before 1.7.53 and 2.0.0-rc.8 lets a remote unauthenticated visitor crash or degrade a server by requesting on-the-fly image derivatives with absurdly large dimensions. Because Grav::fallbackUrl forwards URL query image actions such as forceResize straight to ImageMedium magic actions with no dimension or pixel ceiling, a single crafted request forces the server to allocate huge amounts of memory and CPU to build the derivative. No public exploit identified at time of analysis, but the attack is trivial and scriptable given the CVSS 4.0 VA:H, AV:N/AC:L/PR:N profile.
Denial of service in Grav CMS before 2.0.1 allows authenticated users to exhaust server storage by uploading a crafted ZIP archive (a decompression bomb) that the ZipArchiver::extract() routine expands without enforcing limits on uncompressed size, file count, or nesting depth. The CVSS 4.0 base score of 7.1 reflects a network-reachable, low-privilege flaw whose sole impact is high availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive configuration exfiltration in Grav CMS before 2.0.2 lets an authenticated page author bypass the Twig sandbox and read the full config tree, including plugin SMTP credentials, API keys, and database passwords. The flaw is an incomplete fix for the earlier GHSA-j274-39qw-32c9 sandbox escape: the redacted 'config' facade is still trivially bypassed through the allow-listed grav.offsetGet('config') call. No public exploit has been identified at time of analysis, though the bypass technique is fully described in the vendor advisory.
Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. CVSS 7.7 (High) with confirmed scope change reflects cross-tenant impact in multi-admin environments. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav CMS 2.0.0 through 2.2.4 lets page authors harvest visitors' HTTP Basic authentication credentials - including administrator usernames and passwords - by rendering the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, into page content such as an inline style background image that beacons the captured values to an external host. Exploitation is precondition-heavy: the site must actually be protected by HTTP Basic auth so those PHP variables are populated, the attacker must already hold a page-author account permitted to write raw Twig/HTML page content (PR:L), and a credential-bearing victim such as an administrator must actively view the authored page (UI:P) before their browser issues the outbound request. No public exploit code was identified at time of analysis, and the vendor addressed the flaw in Grav 2.2.5; the assessed severity is moderate (CVSS 4.0: 6.9; CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) rather than an unauthenticated remote compromise.
Grav Star Ratings plugin versions 2.0.1 through 2.0.3 allow unauthenticated visitors to submit votes on restricted or disabled ratings because the vote_access and readonly restrictions are enforced only in client-side code. Attackers can obtain the anonymous nonce that getData() already emits publicly and call addVote() directly, manipulating rating aggregates; the confirmed impact is limited to data integrity with no confidentiality or availability loss. No public exploit code or active exploitation is identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Disabled accounts in Grav API plugin versions before 1.0.36 can continue to access API endpoints because SessionAuthenticator fails to re-validate account state on subsequent requests. Affected are authenticated users who hold a still-valid browser session or remember-me token obtained prior to account disabling, allowing them to bypass operator revocation until the session expires. No public exploit identified at time of analysis, and exploitation requires a pre-existing valid session, limiting the risk to moderate severity.
Missing authorization and cross-site request forgery flaws in the Grav Guestbook plugin versions 0.5.0 and 0.5.1 allow an authenticated admin without the admin.guestbook permission, or an external site leveraging a logged-in moderator's session via nonce-less GET requests, to delete or approve guestbook entries. The impact is limited to the integrity of guestbook content, with no confidentiality or availability effect and no code execution. The CVSS 4.0 base score is 5.3, no public exploit code is identified in the provided intelligence, and the issue is not listed in CISA KEV.
Unauthenticated attackers can delete arbitrary files stored under the user/data/ directory in installations of the Grav Data Manager plugin versions 1.4.0 through 1.4.5 when the classic Admin integration is active. The vulnerability arises from missing authorization checks and absent CSRF nonce validation, enabling requests with a delete parameter and a known data type/filename to remove files such as form submissions. This moderate-severity flaw (CVSS 4.0 base score 6.9; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) has no public exploit identified at time of analysis, and exploitation is limited to integrity and availability impacts on existing data files.
A two-factor authentication bypass in the Grav Login plugin (grav-plugin-login) versions 3.8.7 through 3.9.6 allows a remote attacker who already knows a member's password to read content that the site gates behind the no-argument authenticated() Twig function, the group form authenticated(null, 'group'), or the [authenticated] shortcode, because Login::isAuthenticated() checked only the session flag showing the password step had succeeded rather than the flag showing login had fully completed. The flaw (CWE-304, missing critical step in authentication) does not grant a completed session: the attacker cannot reach pages protected by an access: rule, cannot act as the member, and cannot use the permission-based authenticated('some.permission') form, so impact is confined to disclosure of that gated content. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), though the vendor has released a fix in 3.9.7.
Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.
Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.
Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Cross-site request forgery in Grav Login Plugin prior to 3.8.11 allows a network attacker to silently overwrite a logged-in victim's TOTP two-factor authentication secret by inducing a single link click. The taskRegenerate2FASecret endpoint accepted top-level GET requests with no nonce, Origin, or Referer validation; under the browser-default SameSite=Lax cookie policy, this is sufficient for a cross-site navigation to carry the victim's session cookie and trigger secret regeneration. No public exploit has been identified at time of analysis; the vendor released a confirmed fix in version 3.8.11.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Configuration secret exposure in Grav (all versions prior to 2.0.2) allows authenticated page authors to exfiltrate sensitive plugin credentials - including SMTP passwords, API keys, and plugin database credentials - through a Twig sandbox bypass. The Grav container's offsetGet and __get methods were allow-listed, enabling page-authored Twig to obtain the raw Config object, while serialization filters (json_encode, print_r, yaml_encode, string) were not routed through GravSecurityPolicy::checkMethodAllowed, so the sandbox's member-access gate was never triggered. The vendor-released fix is confirmed in version 2.0.2; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holding api.media.write permission to upload a malicious SVG file whose embedded JavaScript executes in any victim's browser that opens the file. The upload pipeline in HandlesMediaUploads::processUploadedFile() checks the SVG filename extension but omits the Security::sanitizeSVG() call, so script content passes through unmodified and is later served as Content-Type: image/svg+xml, triggering browser-side execution. Successful exploitation enables session token theft and impersonation of the victim; no public exploit has been identified at time of analysis, and vendor-released patch version 1.0.2 is available.
Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.
Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
Scope cap bypass in the Grav API plugin before 1.0.13 allows a holder of a scoped API key issued on a super admin account to call unauthorized DemoController operations. The private requireSuper() method exits early after confirming isSuperAdmin(), never reaching requirePermission() where api_key_scopes enforcement occurs, making the scope restriction on that key inert for the baseline() and reset() endpoints. Impact is bounded to demo-engine control - forced demo resets or baseline captures - and is conditional on demo mode being actively configured with writable resources. No public exploit is identified at time of analysis.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.15 allows authenticated form authors to inject arbitrary HTML and JavaScript into radio and toggle field option labels, which then execute in the browsers of any visitor or administrator rendering that form. The root cause is Twig's |raw filter being applied to user-controlled label content, bypassing the template engine's automatic output encoding. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.1 accurately reflects the requirement for prior authentication with form-authoring privileges.
Path traversal in Grav CMS backup profile validation exposes arbitrary server files to authenticated users with profile editor privileges. All Grav versions before 2.0.13 fail to canonicalize or allowlist backup profile root paths, relying instead on an insufficient hard-coded deny-list, allowing traversal sequences such as '../../opt' to be accepted. An attacker holding a profile editor account can configure a malicious backup profile, trigger a backup job, and download an archive containing sensitive files from directories like /opt, /mnt, or /srv that reside entirely outside GRAV_ROOT. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.
ReDoS in Grav CMS's Twig sandbox allows an authenticated page editor to crash the web server process via a catastrophically backtracking PCRE pattern supplied to the `regex_replace` filter. Affected versions are all Grav releases prior to 2.0.4. Exploitation requires a non-default configuration (`security.twig_content.process_enabled: true`) and at least page-editor-level authentication, limiting blast radius to deployments that have deliberately unlocked Twig processing in page content. No public exploit code or CISA KEV listing has been identified at time of analysis.
CSRF in grav-plugin-login before 3.8.11 allows a remote unauthenticated attacker to rotate a logged-in victim's TOTP secret by luring them to an attacker-controlled page that performs a top-level GET navigation to the Grav site's regenerate2FASecret task endpoint. Because Grav dispatches frontend tasks via GET URI parameters and the default SameSite=Lax session cookie policy permits cross-origin top-level GET navigations to carry cookies, the victim's authenticator app is silently invalidated, forcing 2FA re-enrollment - though the attacker gains no account access. No public exploit has been identified at time of analysis; CVSS 4.0 score is 2.3, reflecting genuinely low severity.
Broken access control in Grav Flex-Objects before 1.4.3 permits authenticated users holding only the api.access permission to perform full CRUD operations on directories lacking explicit permission configurations via the admin-next REST API. The vulnerability bypasses intended authorization controls (CWE-862) because the REST API fails to enforce object-level permission checks when no explicit policy is defined for a directory. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 AT:P metric confirms exploitation depends on the target instance containing permission-less directories, which may be common in default or lightly configured deployments.
Remote code execution in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is achievable by authenticated API users holding the api.media.write permission via a double-extension file upload bypass. The HandlesMediaUploads::validateFileExtension() method uses PHP's pathinfo() to inspect only the final file extension, meaning a file named shell.php.jpg passes the dangerous-extension blocklist while retaining a .php segment that certain web server configurations will execute as PHP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and exploitation is low-complexity once permission prerequisites are met.
Stored cross-site scripting (XSS) in Grav CMS 2.0.0 allows authenticated attackers with page-write API permission to inject JavaScript payloads that execute in visitors' browsers. The vulnerability arises when Twig content processing is enabled, leveraging Twig's string concatenation operator to bypass the XSS validator. Patched in version 2.0.1; proof-of-concept code is available but no known active exploitation.
Insufficient session invalidation in the Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 renders stolen JWT access tokens permanently valid for up to one hour post-compromise. Because tokens are issued without a jti (JWT ID) claim, the server retains no mechanism to selectively revoke them - meaning logout events, password resets, new token issuance, and even account disablement are all ineffective at terminating an active attacker's session. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 vector (AV:N/AC:L/PR:N) reflects that any attacker already in possession of a token can trivially exploit this revocation gap over the network.
Disk exhaustion and crash vulnerability in Grav's Direct Install tool allows an authenticated admin.super user to upload a specially crafted ZIP archive that decompresses without bound, filling the server disk or crashing the process. Affecting all Grav releases prior to 2.0.0, the root cause is the Installer::unZip method invoking PHP's ZipArchive::extractTo with no enforced limits on uncompressed size, entry count, or directory depth - a classic zip bomb attack surface. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released fix is available in version 2.0.0.
DSN string injection in grav-plugin-database prior to version 1.2.0 allows an administrator with Grav CMS plugin configuration access to manipulate PDO database connection strings by injecting unsanitized YAML field values. The vulnerable `Database::__call` method concatenates fields such as host, dbname, charset, server, database, directory, and filename directly into DSN strings without validation, enabling DSN attribute injection or path traversal to redirect database connections to unintended targets. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 1.2.0.
Stored XSS in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.3 allows an authenticated attacker holding the api.media.write permission to upload a malicious SVG file that executes arbitrary JavaScript in an administrator's browser session. The POST /api/v1/media endpoint's HandlesMediaUploads::processUploadedFile() method validates only the file extension and never calls Security::sanitizeSVG(), so the uploaded file is stored and served verbatim with Content-Type: image/svg+xml. When an administrator opens the file directly or via an embedded object or iframe, the injected script runs in the admin's authenticated session context, enabling cookie theft and full session hijacking. No public exploit or active exploitation has been identified at time of analysis.
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full server compromise through admin account creation or code execution.
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make the server issue arbitrary HTTP requests, but only when page content is processed through Twig templates and the configuration permits registration of undefined PHP functions. Public exploit code exists, though EPSS is low (0.29%) and no active exploitation has been confirmed in CISA KEV. The independent assessment notes that signals conflict and should be weighed carefully, rating the vulnerability as CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting the significant non-default prerequisites.
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. This vulnerability is fixed in 1.11.0-beta.1.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.
A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted-such as a single forward slash (/) or an XSS test string-it causes a fatal regular expression parsing error on the server. This leads to application-wide failure due to the use of the preg_match() function with an improperly constructed regular expression, resulting in an error. Once triggered, the site becomes completely unavailable to all users. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes non-functional, causing significant disruptions to administrative operations. The only way to recover from this issue is to manually access the host server and modify the backup.yaml file to correct the corrupted cron expression. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory. The impact of this vulnerability depends on the privileges of the user account running the application. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effectively allows privilege escalation from limited user-manager permissions to full administrator access. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password. This vulnerability is fixed in 1.8.0-beta.27.
Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a content management system (CMS). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Grav is a file-based Web-platform built in PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Grav is a flat-file content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Code Injection in GitHub repository getgrav/grav prior to 1.7.34. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
stored xss in GitHub repository getgrav/grav prior to 1.7.33. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.