Grav
Monthly
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Path traversal in Grav CMS before 1.10.55 allows an authenticated admin user with the admin.pages.create permission to write arbitrary Markdown files outside the intended pages directory by embedding traversal sequences in the lang POST parameter of the admin plugin's Save As action. The vulnerability gives an attacker-controlled write primitive constrained to .md file extensions, which - depending on Grav's template and plugin layout - may be chained to persistent backdoor placement or secondary code execution. No public exploit has been identified at time of analysis, and exploitation is bounded by requiring a valid authenticated admin session.
reCAPTCHA v3 bot protection in the Grav Form plugin (getgrav/grav-plugin-form) 8.0.6 through 9.1.19 can be fully bypassed by an anonymous remote attacker who submits a token under the wrong field name. Because the plugin picks which reCAPTCHA validation branch to run based only on which response field key appears in the payload, sending a v3 token in the v2 field (g-recaptcha-response) forces the v2 code path, which never checks the risk score threshold or the expected action. There is publicly available advisory detail from VulnCheck but no public exploit identified at time of analysis and no evidence of active exploitation.
Broken authorization in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 lets a holder of a scoped API key view - and potentially edit - a page's security/permission blueprint section beyond the scope their key was granted. The flaw lives in injectSecurityTab() of BlueprintController, which decides editability using raw isSuperAdmin()/hasPermission() checks and never calls scopeAllows(), so the per-key scope cap is silently bypassed. There is no public exploit identified at time of analysis and no KEV listing; the reporter (VulnCheck) explicitly could not confirm the end-to-end write-time impact, so confirmed effect is at least unauthorized disclosure of permission fields.
Broken authorization in getgrav/grav-plugin-api before 1.0.18 lets a scoped API key that belongs to a super-admin account perform privileged user-management actions it was never scoped for. Across seven sensitive endpoints the requireNotSuperTarget() guard in UsersController.php checks isSuperAdmin() on the underlying account instead of whether the presented key carries super authority (isSuperWithinScope()), so a deliberately down-scoped key can act against other super-admin accounts-disabling their 2FA, deleting avatars, and minting or deleting their API keys. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not on CISA KEV.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.
Email address enumeration in the Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 lets unauthenticated remote attackers determine which email addresses are registered on a Grav CMS site. The register() method returns a distinct EMAIL_NOT_AVAILABLE error for already-registered addresses while proceeding normally otherwise, and because the registration endpoint enforces no rate limiting, an attacker can test addresses at scale, one per request. No public exploit identified at time of analysis; the assigned CVSS 4.0 score of 9.3 appears substantially inflated for what is fundamentally an information-disclosure weakness.
Configuration secret disclosure in Grav CMS before 2.0.16 allows authenticated content editors to extract sensitive values - including cache credentials - from system, site, and theme configuration arrays via the Twig templating engine. The sandboxed Twig render context fails to filter these configuration objects, permitting attackers to bypass the intended config_denied_paths restrictions using standard dot-notation syntax. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.1 reflects a high confidentiality impact for installations where editor access is not fully trusted.
Path traversal in Grav CMS before 2.0.16 exposes arbitrary server-side files to authenticated page authors through the `media_directory()` Twig function, which fails to validate attacker-supplied filesystem paths. Users holding page authoring privileges can supply arbitrary paths to `media_directory()` and then invoke the allow-listed filepath accessor on the resulting Medium object to read the contents of any file accessible to the web server process whose extension matches the CMS media allow-list. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low privilege requirement and high confidentiality impact make this a meaningful risk in any multi-author or externally-accessible Grav deployment.
Symlink following in Grav CMS Scheduler's Job::createLockFile() enables local attackers to overwrite arbitrary files writable by the web server process, affecting all versions prior to 2.0.16. The flaw arises because lock files are written to predictable paths inside a world-writable temp directory with no verification that the target path is not an attacker-controlled symlink; the next scheduled job execution blindly writes the job ID string to whatever the symlink points at. No public exploit has been identified at time of analysis, but the predictable path and world-writable directory make the conditions straightforward to stage on shared-hosting or multi-tenant systems.
Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.
Broken authorization in the Grav Login plugin before 1.0.16 lets an operator holding the api.users.write permission clear login lockout counters on admin.super accounts through the onApiUserListRowAction unlock handler, which never checks the target account's privilege tier. This strips brute-force protection from the highest-privilege accounts, enabling a lower-privileged user to set up password-guessing against super-admin credentials. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.
Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the `authorize` ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis, but the low privilege bar and network accessibility make this a credible insider or compromised-account threat on multi-author Grav installations.
Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5.
Case-sensitivity bypass in Grav's Apache .htaccess rules prior to version 2.0.4 allows unauthenticated remote attackers to retrieve password hashes and security configuration files by requesting uppercase or mixed-case path variants (e.g., `/USER/accounts/admin.yaml`) on case-insensitive filesystems. The protection boundary - Apache mod_rewrite RewriteRule directives blocking access to user/accounts, user/config, user/data, and user/env - fails entirely when the underlying filesystem resolves uppercase URLs to the same protected files that lowercase rules would block. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no user interaction, making it trivially repeatable against eligible deployments.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.
Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the api.webhooks.write permission register webhook URLs that the server dereferences with no protocol allow-listing. Because WebhookController.php validates the URL only with FILTER_VALIDATE_URL and WebhookDispatcher.php builds cURL without CURLOPT_PROTOCOLS/CURLOPT_REDIR_PROTOCOLS, an attacker can force the server to fetch file://, gopher://, dict://, and private/link-local targets, exfiltrating local files and internal HTTP responses including cloud metadata credentials. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause and fix are confirmed in the vendor advisory and commit.
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in the vendor GHSA advisory.
Missing authorization enforcement in the Grav API plugin before 1.0.14 allows any authenticated user holding the api.access permission to invoke privileged menubar actions - bypassing per-action authorize field evaluation in MenubarController::executeAction(). The POST /api/v1/menubar/actions/{plugin}/{action} endpoint checks only the baseline api.access gate while the parallel GET listing endpoint correctly calls userPassesAuthorize(), creating an asymmetric enforcement gap (CWE-862). On stock Grav installs the impact is currently latent because no bundled core plugin registers a privileged authorize handler, but any environment deploying third-party plugins that rely on the documented authorize contract is exposed to privilege escalation. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Broken API-key scope enforcement in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.14 lets an authenticated holder of a restricted, scoped API key read authorize-gated administrative UI metadata that their scope should forbid. Because userPassesAuthorize() checks the underlying account's super-admin flag and ACL grants instead of the presenting key's declared scopes, a low-privilege key minted on a privileged account inherits the account's full authorization, exposing sidebar/menubar/widget item definitions and users-list columns, row-actions, and filter-tabs. No public exploit identified at time of analysis; impact is information disclosure only, and the published CVSS 4.0 9.3 appears materially overstated versus the described effect.
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before 1.0.15 lets a holder of a narrowly-scoped API key act outside its granted scope. Because BlueprintPathResolver::resolveUserScope() checks the underlying account's raw super-admin ACL flag (access.api.super) rather than the scope actually minted into the presented key, an attacker with a key limited to api.media.write on a super-admin account can write files into other users' account directories and enumerate their file listings without holding api.users.write. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Grav Plugin API versions 1.0.0-beta.10 through 1.0.14 enables an authenticated editor-level user to write attacker-controlled page content and media to arbitrary filesystem locations accessible to the web server process. The root cause is an incomplete fix for a prior related path traversal (GHSA-qjq4-jp55-4mx2) that left the 'suffix' parameter of the PagesController::batchCopy() method unvalidated against directory escape sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 1.0.15 resolves the issue.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Path traversal in Grav CMS before 2.0.15 allows unauthenticated remote attackers to read arbitrary files from sibling directories outside the intended asset root by exploiting a string prefix collision in the static asset handler. The index.php front controller validates asset paths using a simple string prefix check rather than normalized directory-boundary logic, so a request for /assets-private/credentials.yaml passes validation when /assets is the configured base. No public exploit code has been identified and this vulnerability is not in the CISA KEV catalog; the CVSS 4.0 score of 8.2 reflects high confidentiality risk conditioned on a specific deployment layout (AT:P) rather than universal exploitability.
Privilege escalation in getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 allows any holder of a scoped, read-only API key to perform super-admin write operations - including rewriting group ACL maps to elevate arbitrary accounts to super-admin. The flaw exists because four privileged write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) authorize via an isSuperAdmin() early-return that entirely skips requirePermission(), the only function that enforces scope caps on API keys. A leaked CI or monitoring key with a minimal scope such as api.pages.read is sufficient to achieve full administrative compromise. No public exploit code has been identified at time of analysis, and a patch is available in version 1.0.13.
Privilege escalation in Grav's Flex Objects plugin (through version 1.4.6, confirmed against Grav 2.0.11) allows an authenticated low-privileged admin to achieve full site takeover by exploiting a missing authorization check in FlexApiController::update(). The generic /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups API endpoints omit the field-level, target, and super-admin guards enforced by the dedicated Users and Groups controllers, so an account holding only api.access, admin.login, and users.update can overwrite a super administrator's password or self-grant admin.super group membership. No public exploit is identified at time of analysis; vendor-released patch Flex Objects 1.4.7 is available.
Remote code execution in Grav API plugin versions before 1.0.13 is achievable by any attacker holding a scoped api.config.write API key. The ConfigController fails to enforce its super-scope gates, permitting scoped keys to overwrite scheduler.custom_jobs configuration that Grav subsequently executes via the Symfony Process component. A public exploit exists per SSVC data, the attack is rated automatable, and technical impact is assessed as total - making this a high-priority patching target despite a low EPSS score.
Privilege escalation in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 allows an authenticated API key holder with api.users.write scope to silently bypass the scope-cap enforcement and self-elevate to super-administrator. The flaw lies in UsersController's create() and update() methods, which validate scope caps only for api.users.write actions but fall back to a bare isSuperAdmin() check - reading access.api.super from the parent account rather than the key's own scope - when granting super privileges, allowing a limited key on a super account to mint or promote unrestricted admin accounts. A proof-of-concept exists per SSVC assessment, CISA rates exploitation as automatable with total technical impact, and a vendor-released patch is available at version 1.0.13.
Privilege escalation in Grav Plugin API before 1.0.13 allows an attacker controlling a minimal api.users.write API key - issued under a super admin account - to craft invitation records that embed super-admin access flags, which are written verbatim to any account that accepts the invitation. The root cause is CWE-269 improper privilege management: InvitationsController's strip-super and accept-groups decisions evaluate isSuperAdmin() against the owning account rather than against the API key's declared scope, so a deliberately restricted key silently retains the owner's super-admin authority for these checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Privilege escalation in the getgrav/grav-plugin-api plugin before 1.0.13 allows an authenticated attacker holding only a minimal api.access-scoped key on a super account to mint a full-access, unscoped super key by exploiting missing scope-subset enforcement in createApiKey. The self-target path of requireApiKeyPermission() enforces only the baseline api.access scope, while the new key's scopes are taken verbatim from the attacker-controlled request body with no validation that they fall within the caller's granted scopes. Submitting an empty scopes array produces a key with unrestricted super privileges, directly enabling further attack chains including configuration-write-to-RCE. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS is 0.30% (23rd percentile). Vendor-released patch version 1.0.13 is available.
Scope-cap bypass in grav-plugin-api before 1.0.13 allows a holder of a least-privilege api.config.write API key issued on a super-admin account to append arbitrary tokens to Grav's Twig sandbox allowlist (persisted to user/config/security.yaml) via the POST /reports/twig-content/allowlist endpoint. Widening the allowlist eliminates the Twig sandbox boundary, converting any subsequent content render into a server-side template injection (SSTI) sink and ultimately enabling remote code execution on the host. No public exploit has been confirmed and the CVE does not appear in CISA KEV at time of analysis, but the two-step primitive - allowlist poisoning followed by SSTI/RCE - is a well-understood attack class in CMS security research.
Server-side template injection (SSTI) leading to remote code execution in the Grav CMS API plugin (getgrav/grav-plugin-api) before version 1.0.13 is reachable by any low-privilege API key holder whose key was minted on a super-admin account. The root flaw is in PagesController::guardTwigContent(), which gates Twig processing via a bare isSuperAdmin() call that ignores the api_key_scopes array, allowing a key deliberately scoped to api.pages.write to enable process.twig on page save despite admin.pages_twig being intentionally excluded from that scope. A public proof-of-concept exists per SSVC data; exploitation is classified as automatable with total technical impact, making this a high-priority patch target for any Grav deployment where the required non-default configuration is active.
Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. No active exploitation is currently confirmed (SSVC Exploitation: none; EPSS 0.34%), but SSVC rates this automatable with total technical impact, making prompt patching critical for any instance exposing the API with delegated keys.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Path traversal in Grav CMS versions before 2.0.11 enables authenticated editors to disclose arbitrary server-side files to unauthenticated visitors through the image watermark feature. The function ImageMedium::watermark() forwards unsanitized editor-controlled input to the resource locator, whose file:// scheme handler normalizes paths using only lexical '..' collapsing - never verifying containment within the media sandbox - so a crafted Markdown image directive causes the CMS to composite a traversed file into a cached image served at a public, unauthenticated URL. No public exploit has been identified at time of analysis; however, the high confidentiality impact and ease of exploitation once editor access is obtained make this a priority patch for multi-tenant Grav deployments with untrusted editors.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Cross-origin data exposure in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 stems from a hardcoded 'Access-Control-Allow-Origin: *' header returned on every response, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin authenticates via the Authorization and X-API-Token request headers rather than cookies, any malicious website scripting a leaked access token can read the response bodies of authenticated endpoints and perform write actions as that token's user. Reported by VulnCheck with no public exploit identified at time of analysis; not listed in CISA KEV.
Sensitive token exposure in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 allows attackers to hijack valid admin sessions after JWT access tokens leak from URLs. Because JwtAuthenticator::extractBearerToken accepts tokens via the ?token= query string on every API route, those tokens are written verbatim into web server access logs, Referer headers, browser history, and upstream proxy/CDN logs, and any captured token grants full admin API access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 score of 8.2 reflects the high value of the leaked admin credentials.
Server-side request forgery in Grav CMS before 2.0.4 allows authenticated users holding the api.webhooks.write permission to register webhooks with dangerous cURL protocol handlers (file://, dict://, gopher://) that fire when webhook events trigger. By abusing these unrestricted protocols an attacker can read local files, enumerate process and service information, and pivot to internal-only network services from the trust position of the Grav server. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is driven by the CWE-918 primitive rather than confirmed in-the-wild activity.
Privilege escalation in the getgrav grav-plugin-api before 1.0.6 allows a low-privileged manager holding the api.users.write permission to become a super-admin. The createApiKey, generate2fa, and disable2fa endpoints never re-check super-admin status, so an attacker can mint API keys bound to super-admin accounts or strip 2FA from super-admin users and take over the entire Grav instance. No public exploit identified at time of analysis, but the vendor GHSA advisory and VulnCheck confirm the flaw.
Two-factor authentication bypass in Grav CMS before 2.0.4 lets an attacker who already knows a victim's password overwrite that user's TOTP secret and log in with full 2FA protection stripped away. During the pending TOTP challenge window the login plugin's regenerate2FASecret task verifies only that the user exists — not that the caller is authorized — and requires no CSRF nonce, so the attacker sets an attacker-chosen secret, computes a valid code, and completes login. VulnCheck-reported and CVSS 4.0 scored 9.1; no public exploit identified at time of analysis.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 lets any valid API key perform actions far beyond its intended scope. Although keys can be provisioned with a restricted scopes array (e.g. read-only), the ApiKeyAuthenticator class never reads or enforces those scopes and instead returns the owning user's full account object, so a limited key can execute any write, delete, or administrative operation the owner is entitled to. Reported by VulnCheck with no public exploit identified at time of analysis, but the flaw is trivially exploitable by any key holder against default configurations.
Sensitive configuration file disclosure in Grav CMS before 2.0.4 lets unauthenticated remote attackers bypass the bundled .htaccess protections by requesting blocked file types with uppercase or mixed-case extensions (e.g., .YAML, .PHP). The shipped rules omit the Apache [NC] flag, so extension matching is case-sensitive and fails to block case variants on case-insensitive filesystems (Windows/NTFS, macOS/HFS+, Docker volume mounts), exposing files that may hold API keys and credentials. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
Denial of service in Grav CMS 2.0.1 lets a trusted package source or admin-level uploader bypass the newly added decompression-bomb size cap and exhaust disk space or inodes on the host. The 2.0.1 cap trusts the attacker-forgeable uncompressed size declared in each ZIP central-directory entry rather than the actual inflated stream, so a crafted archive declaring tiny sizes slips past the check while extraction writes the real, far larger payload. This is an incomplete fix for GHSA-928x-9mpw-8h56, corrected in 2.0.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 exposes a window.__GRAV_CONFIG__ JavaScript object on the /grav/admin SPA bootstrap page and its subroutes, leaking exact Grav and Admin2 version numbers, server URL, API prefix, admin base path, and runtime environment to any unauthenticated visitor. Reported by VulnCheck, the flaw lets remote unauthenticated attackers fingerprint a deployment and pre-select version-specific exploits with zero active reconnaissance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in grav-plugin-admin ≤ 1.10.52 allows an authenticated attacker holding admin.users permission to take over any Grav account - including the super administrator - by sending a single crafted POST request to the user-save endpoint with a data[password] field. The saveUser() method in AdminController.php verifies that the caller holds user-management rights but never compares the caller's privilege tier against the target account's, enabling silent super-admin password replacement. SSVC marks exploitation as poc-level with total technical impact; vendor-released patch is version 1.10.53.
SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.
Uncontrolled resource consumption in Grav flat-file CMS before 1.7.53 and 2.0.0-rc.8 lets a remote unauthenticated visitor crash or degrade a server by requesting on-the-fly image derivatives with absurdly large dimensions. Because Grav::fallbackUrl forwards URL query image actions such as forceResize straight to ImageMedium magic actions with no dimension or pixel ceiling, a single crafted request forces the server to allocate huge amounts of memory and CPU to build the derivative. No public exploit identified at time of analysis, but the attack is trivial and scriptable given the CVSS 4.0 VA:H, AV:N/AC:L/PR:N profile.
Denial of service in Grav CMS before 2.0.1 allows authenticated users to exhaust server storage by uploading a crafted ZIP archive (a decompression bomb) that the ZipArchiver::extract() routine expands without enforcing limits on uncompressed size, file count, or nesting depth. The CVSS 4.0 base score of 7.1 reflects a network-reachable, low-privilege flaw whose sole impact is high availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive configuration exfiltration in Grav CMS before 2.0.2 lets an authenticated page author bypass the Twig sandbox and read the full config tree, including plugin SMTP credentials, API keys, and database passwords. The flaw is an incomplete fix for the earlier GHSA-j274-39qw-32c9 sandbox escape: the redacted 'config' facade is still trivially bypassed through the allow-listed grav.offsetGet('config') call. No public exploit has been identified at time of analysis, though the bypass technique is fully described in the vendor advisory.
Arbitrary code execution in Grav CMS before 2.0.0-beta.2 stems from three distinct flaw classes: PHP object injection via unsafe unserialize() of attacker-controllable data in the Scheduler JobQueue, FileCache adapter, and Session components, an OS command injection in the plugin/theme InstallCommand git clone routine, and a Twig sandbox blocklist bypass enabling server-side template injection. An attacker who can influence the serialized input can chain available gadgets to run arbitrary PHP, while the command-injection path is reachable by authenticated administrators through plugin/theme installation. No public exploit identified at time of analysis; the issues were privately reported by VulnCheck and are fixed in 2.0.0-beta.2.
Arbitrary file disclosure in Grav CMS versions prior to 2.0.0-beta.2 allows authenticated admin-panel users to read sensitive server files via XML External Entity (XXE) injection in SVG upload processing. The flaw stems from simplexml_load_string() being called without entity-loader protections, enabling exfiltration of credentials, configuration, and environment secrets. No public exploit identified at time of analysis, though the GHSA advisory includes a working proof-of-concept payload.
Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. CVSS 7.7 (High) with confirmed scope change reflects cross-tenant impact in multi-admin environments. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.
Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.
Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
Configuration secret exposure in Grav (all versions prior to 2.0.2) allows authenticated page authors to exfiltrate sensitive plugin credentials - including SMTP passwords, API keys, and plugin database credentials - through a Twig sandbox bypass. The Grav container's offsetGet and __get methods were allow-listed, enabling page-authored Twig to obtain the raw Config object, while serialization filters (json_encode, print_r, yaml_encode, string) were not routed through GravSecurityPolicy::checkMethodAllowed, so the sandbox's member-access gate was never triggered. The vendor-released fix is confirmed in version 2.0.2; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.
Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
Scope cap bypass in the Grav API plugin before 1.0.13 allows a holder of a scoped API key issued on a super admin account to call unauthorized DemoController operations. The private requireSuper() method exits early after confirming isSuperAdmin(), never reaching requirePermission() where api_key_scopes enforcement occurs, making the scope restriction on that key inert for the baseline() and reset() endpoints. Impact is bounded to demo-engine control - forced demo resets or baseline captures - and is conditional on demo mode being actively configured with writable resources. No public exploit is identified at time of analysis.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.15 allows authenticated form authors to inject arbitrary HTML and JavaScript into radio and toggle field option labels, which then execute in the browsers of any visitor or administrator rendering that form. The root cause is Twig's |raw filter being applied to user-controlled label content, bypassing the template engine's automatic output encoding. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.1 accurately reflects the requirement for prior authentication with form-authoring privileges.
Remote code execution in Grav CMS (versions ≤2.0.17) lets authenticated users holding only page-write rights achieve arbitrary PHP execution on the web server by exploiting a Twig sandbox bypass in the |sort filter. The sortFunc wrapper in GravExtension.php incorrectly hardcodes isSandboxed=false-unlike |map, |filter, and |reduce-allowing |sort to resolve plain PHP callable names including spl_autoload, which is absent from the function denylist and performs a PHP include operation. A content editor can deliver a crafted payload through mechanisms such as form frontmatter rendered by the Email plugin, resulting in code execution as the web server user. A vendor-released patch is available in version 2.0.19, and no active exploitation appears in CISA KEV at time of analysis.
Path traversal in Grav CMS before 1.10.55 allows an authenticated admin user with the admin.pages.create permission to write arbitrary Markdown files outside the intended pages directory by embedding traversal sequences in the lang POST parameter of the admin plugin's Save As action. The vulnerability gives an attacker-controlled write primitive constrained to .md file extensions, which - depending on Grav's template and plugin layout - may be chained to persistent backdoor placement or secondary code execution. No public exploit has been identified at time of analysis, and exploitation is bounded by requiring a valid authenticated admin session.
reCAPTCHA v3 bot protection in the Grav Form plugin (getgrav/grav-plugin-form) 8.0.6 through 9.1.19 can be fully bypassed by an anonymous remote attacker who submits a token under the wrong field name. Because the plugin picks which reCAPTCHA validation branch to run based only on which response field key appears in the payload, sending a v3 token in the v2 field (g-recaptcha-response) forces the v2 code path, which never checks the risk score threshold or the expected action. There is publicly available advisory detail from VulnCheck but no public exploit identified at time of analysis and no evidence of active exploitation.
Broken authorization in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 lets a holder of a scoped API key view - and potentially edit - a page's security/permission blueprint section beyond the scope their key was granted. The flaw lives in injectSecurityTab() of BlueprintController, which decides editability using raw isSuperAdmin()/hasPermission() checks and never calls scopeAllows(), so the per-key scope cap is silently bypassed. There is no public exploit identified at time of analysis and no KEV listing; the reporter (VulnCheck) explicitly could not confirm the end-to-end write-time impact, so confirmed effect is at least unauthorized disclosure of permission fields.
Broken authorization in getgrav/grav-plugin-api before 1.0.18 lets a scoped API key that belongs to a super-admin account perform privileged user-management actions it was never scoped for. Across seven sensitive endpoints the requireNotSuperTarget() guard in UsersController.php checks isSuperAdmin() on the underlying account instead of whether the presented key carries super authority (isSuperWithinScope()), so a deliberately down-scoped key can act against other super-admin accounts-disabling their 2FA, deleting avatars, and minting or deleting their API keys. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not on CISA KEV.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Password reset and account activation token comparison in Grav Login Plugin before 3.9.1 uses PHP's non-constant-time === operator instead of hash_equals(), exposing a CWE-208 timing oracle in both taskReset() (classes/Controller.php) and the activation handler (login.php). Combined with the absence of rate limiting on the token-submission endpoint, an unauthenticated network attacker can submit high-volume repeated token guesses against a known username and statistically recover a valid reset token via timing discrepancy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the vendor itself characterizes practical exploitability as low, and no end-to-end network exploitation has been demonstrated.
Email address enumeration in the Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 lets unauthenticated remote attackers determine which email addresses are registered on a Grav CMS site. The register() method returns a distinct EMAIL_NOT_AVAILABLE error for already-registered addresses while proceeding normally otherwise, and because the registration endpoint enforces no rate limiting, an attacker can test addresses at scale, one per request. No public exploit identified at time of analysis; the assigned CVSS 4.0 score of 9.3 appears substantially inflated for what is fundamentally an information-disclosure weakness.
Configuration secret disclosure in Grav CMS before 2.0.16 allows authenticated content editors to extract sensitive values - including cache credentials - from system, site, and theme configuration arrays via the Twig templating engine. The sandboxed Twig render context fails to filter these configuration objects, permitting attackers to bypass the intended config_denied_paths restrictions using standard dot-notation syntax. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.1 reflects a high confidentiality impact for installations where editor access is not fully trusted.
Path traversal in Grav CMS before 2.0.16 exposes arbitrary server-side files to authenticated page authors through the `media_directory()` Twig function, which fails to validate attacker-supplied filesystem paths. Users holding page authoring privileges can supply arbitrary paths to `media_directory()` and then invoke the allow-listed filepath accessor on the resulting Medium object to read the contents of any file accessible to the web server process whose extension matches the CMS media allow-list. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low privilege requirement and high confidentiality impact make this a meaningful risk in any multi-author or externally-accessible Grav deployment.
Symlink following in Grav CMS Scheduler's Job::createLockFile() enables local attackers to overwrite arbitrary files writable by the web server process, affecting all versions prior to 2.0.16. The flaw arises because lock files are written to predictable paths inside a world-writable temp directory with no verification that the target path is not an attacker-controlled symlink; the next scheduled job execution blindly writes the job ID string to whatever the symlink points at. No public exploit has been identified at time of analysis, but the predictable path and world-writable directory make the conditions straightforward to stage on shared-hosting or multi-tenant systems.
Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.
Broken authorization in the Grav Login plugin before 1.0.16 lets an operator holding the api.users.write permission clear login lockout counters on admin.super accounts through the onApiUserListRowAction unlock handler, which never checks the target account's privilege tier. This strips brute-force protection from the highest-privilege accounts, enabling a lower-privileged user to set up password-guessing against super-admin credentials. Reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Host header injection in Grav CMS before 3.9.2 allows attackers to poison outgoing invitation emails, replacing the legitimate site URL with an attacker-controlled domain in token-bearing links sent via the sendInvitationEmail() function. The vulnerability exploits a gap in Grav's existing Host header defenses: the require_trusted_host protection was applied only to password reset flows, leaving invitation emails without equivalent validation. When a poisoned invitation email is delivered and the recipient clicks the link, the one-time invitation token is transmitted to the attacker's server rather than the legitimate site. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog, though the reported CVSS 4.0 score of 8.7 reflects high confidentiality risk from token capture.
Authorization bypass in the Grav Flex Objects plugin (versions 1.4.0-1.4.7) allows any user holding page-edit access to render arbitrary registered Flex collections - including the full user account directory - by embedding a shortcode in published pages. The shortcode rendering path entirely omits the `authorize` ACL checks enforced in the admin panel, meaning lower-privileged editors can extract sensitive data that would otherwise be restricted to administrators. No public exploit or CISA KEV listing exists at time of analysis, but the low privilege bar and network accessibility make this a credible insider or compromised-account threat on multi-author Grav installations.
Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5.
Case-sensitivity bypass in Grav's Apache .htaccess rules prior to version 2.0.4 allows unauthenticated remote attackers to retrieve password hashes and security configuration files by requesting uppercase or mixed-case path variants (e.g., `/USER/accounts/admin.yaml`) on case-insensitive filesystems. The protection boundary - Apache mod_rewrite RewriteRule directives blocking access to user/accounts, user/config, user/data, and user/env - fails entirely when the underlying filesystem resolves uppercase URLs to the same protected files that lowercase rules would block. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and no user interaction, making it trivially repeatable against eligible deployments.
Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff.
Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the api.webhooks.write permission register webhook URLs that the server dereferences with no protocol allow-listing. Because WebhookController.php validates the URL only with FILTER_VALIDATE_URL and WebhookDispatcher.php builds cURL without CURLOPT_PROTOCOLS/CURLOPT_REDIR_PROTOCOLS, an attacker can force the server to fetch file://, gopher://, dict://, and private/link-local targets, exfiltrating local files and internal HTTP responses including cloud metadata credentials. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause and fix are confirmed in the vendor advisory and commit.
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users permission promote an account to super-admin by saving a group with access[admin][super]=true. The core group blueprint omits the required security@: admin.super guard on the access field, so the operator inherits full super-admin capabilities including the task scheduler and arbitrary Twig template evaluation - effectively code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in the vendor GHSA advisory.
Missing authorization enforcement in the Grav API plugin before 1.0.14 allows any authenticated user holding the api.access permission to invoke privileged menubar actions - bypassing per-action authorize field evaluation in MenubarController::executeAction(). The POST /api/v1/menubar/actions/{plugin}/{action} endpoint checks only the baseline api.access gate while the parallel GET listing endpoint correctly calls userPassesAuthorize(), creating an asymmetric enforcement gap (CWE-862). On stock Grav installs the impact is currently latent because no bundled core plugin registers a privileged authorize handler, but any environment deploying third-party plugins that rely on the documented authorize contract is exposed to privilege escalation. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Broken API-key scope enforcement in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.14 lets an authenticated holder of a restricted, scoped API key read authorize-gated administrative UI metadata that their scope should forbid. Because userPassesAuthorize() checks the underlying account's super-admin flag and ACL grants instead of the presenting key's declared scopes, a low-privilege key minted on a privileged account inherits the account's full authorization, exposing sidebar/menubar/widget item definitions and users-list columns, row-actions, and filter-tabs. No public exploit identified at time of analysis; impact is information disclosure only, and the published CVSS 4.0 9.3 appears materially overstated versus the described effect.
Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before 1.0.15 lets a holder of a narrowly-scoped API key act outside its granted scope. Because BlueprintPathResolver::resolveUserScope() checks the underlying account's raw super-admin ACL flag (access.api.super) rather than the scope actually minted into the presented key, an attacker with a key limited to api.media.write on a super-admin account can write files into other users' account directories and enumerate their file listings without holding api.users.write. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in Grav Plugin API versions 1.0.0-beta.10 through 1.0.14 enables an authenticated editor-level user to write attacker-controlled page content and media to arbitrary filesystem locations accessible to the web server process. The root cause is an incomplete fix for a prior related path traversal (GHSA-qjq4-jp55-4mx2) that left the 'suffix' parameter of the PagesController::batchCopy() method unvalidated against directory escape sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 1.0.15 resolves the issue.
Server-side template injection in grav-plugin-api before 1.0.15 enables remote code execution for any attacker holding api.pages.write permission. The translate() endpoint accepts unsanitized Twig template syntax in header and content parameters, which can be persisted to a page with process.twig enabled and evaluated by the Twig engine at render time. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of network-reachable exploitation path and high confidentiality and integrity impact from full server-side template evaluation makes this a serious risk for any Grav installation exposing the plugin API to lower-trust users.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to write arbitrary PHP into web-accessible files and execute it. The flaw lives in the Blueprint dynamic-data 'bare-function' validation, which relies on an incomplete denylist rather than a positive allowlist, letting the error_log function be invoked through a data directive to append attacker-controlled PHP payloads. Reported by VulnCheck; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Path traversal in Grav CMS before 2.0.15 allows unauthenticated remote attackers to read arbitrary files from sibling directories outside the intended asset root by exploiting a string prefix collision in the static asset handler. The index.php front controller validates asset paths using a simple string prefix check rather than normalized directory-boundary logic, so a request for /assets-private/credentials.yaml passes validation when /assets is the configured base. No public exploit code has been identified and this vulnerability is not in the CISA KEV catalog; the CVSS 4.0 score of 8.2 reflects high confidentiality risk conditioned on a specific deployment layout (AT:P) rather than universal exploitability.
Privilege escalation in getgrav/grav-plugin-api versions 1.0.6 through 1.0.11 allows any holder of a scoped, read-only API key to perform super-admin write operations - including rewriting group ACL maps to elevate arbitrary accounts to super-admin. The flaw exists because four privileged write endpoints (GroupsController, AccountsConfigController, PreferencesController, DashboardWidgetController) authorize via an isSuperAdmin() early-return that entirely skips requirePermission(), the only function that enforces scope caps on API keys. A leaked CI or monitoring key with a minimal scope such as api.pages.read is sufficient to achieve full administrative compromise. No public exploit code has been identified at time of analysis, and a patch is available in version 1.0.13.
Privilege escalation in Grav's Flex Objects plugin (through version 1.4.6, confirmed against Grav 2.0.11) allows an authenticated low-privileged admin to achieve full site takeover by exploiting a missing authorization check in FlexApiController::update(). The generic /api/v1/flex-objects/user-accounts and /api/v1/flex-objects/user-groups API endpoints omit the field-level, target, and super-admin guards enforced by the dedicated Users and Groups controllers, so an account holding only api.access, admin.login, and users.update can overwrite a super administrator's password or self-grant admin.super group membership. No public exploit is identified at time of analysis; vendor-released patch Flex Objects 1.4.7 is available.
Remote code execution in Grav API plugin versions before 1.0.13 is achievable by any attacker holding a scoped api.config.write API key. The ConfigController fails to enforce its super-scope gates, permitting scoped keys to overwrite scheduler.custom_jobs configuration that Grav subsequently executes via the Symfony Process component. A public exploit exists per SSVC data, the attack is rated automatable, and technical impact is assessed as total - making this a high-priority patching target despite a low EPSS score.
Privilege escalation in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 allows an authenticated API key holder with api.users.write scope to silently bypass the scope-cap enforcement and self-elevate to super-administrator. The flaw lies in UsersController's create() and update() methods, which validate scope caps only for api.users.write actions but fall back to a bare isSuperAdmin() check - reading access.api.super from the parent account rather than the key's own scope - when granting super privileges, allowing a limited key on a super account to mint or promote unrestricted admin accounts. A proof-of-concept exists per SSVC assessment, CISA rates exploitation as automatable with total technical impact, and a vendor-released patch is available at version 1.0.13.
Privilege escalation in Grav Plugin API before 1.0.13 allows an attacker controlling a minimal api.users.write API key - issued under a super admin account - to craft invitation records that embed super-admin access flags, which are written verbatim to any account that accepts the invitation. The root cause is CWE-269 improper privilege management: InvitationsController's strip-super and accept-groups decisions evaluate isSuperAdmin() against the owning account rather than against the API key's declared scope, so a deliberately restricted key silently retains the owner's super-admin authority for these checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Privilege escalation in the getgrav/grav-plugin-api plugin before 1.0.13 allows an authenticated attacker holding only a minimal api.access-scoped key on a super account to mint a full-access, unscoped super key by exploiting missing scope-subset enforcement in createApiKey. The self-target path of requireApiKeyPermission() enforces only the baseline api.access scope, while the new key's scopes are taken verbatim from the attacker-controlled request body with no validation that they fall within the caller's granted scopes. Submitting an empty scopes array produces a key with unrestricted super privileges, directly enabling further attack chains including configuration-write-to-RCE. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS is 0.30% (23rd percentile). Vendor-released patch version 1.0.13 is available.
Scope-cap bypass in grav-plugin-api before 1.0.13 allows a holder of a least-privilege api.config.write API key issued on a super-admin account to append arbitrary tokens to Grav's Twig sandbox allowlist (persisted to user/config/security.yaml) via the POST /reports/twig-content/allowlist endpoint. Widening the allowlist eliminates the Twig sandbox boundary, converting any subsequent content render into a server-side template injection (SSTI) sink and ultimately enabling remote code execution on the host. No public exploit has been confirmed and the CVE does not appear in CISA KEV at time of analysis, but the two-step primitive - allowlist poisoning followed by SSTI/RCE - is a well-understood attack class in CMS security research.
Server-side template injection (SSTI) leading to remote code execution in the Grav CMS API plugin (getgrav/grav-plugin-api) before version 1.0.13 is reachable by any low-privilege API key holder whose key was minted on a super-admin account. The root flaw is in PagesController::guardTwigContent(), which gates Twig processing via a bare isSuperAdmin() call that ignores the api_key_scopes array, allowing a key deliberately scoped to api.pages.write to enable process.twig on page save despite admin.pages_twig being intentionally excluded from that scope. A public proof-of-concept exists per SSVC data; exploitation is classified as automatable with total technical impact, making this a high-priority patch target for any Grav deployment where the required non-default configuration is active.
Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. No active exploitation is currently confirmed (SSVC Exploitation: none; EPSS 0.34%), but SSVC rates this automatable with total technical impact, making prompt patching critical for any instance exposing the API with delegated keys.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Path traversal in Grav CMS versions before 2.0.11 enables authenticated editors to disclose arbitrary server-side files to unauthenticated visitors through the image watermark feature. The function ImageMedium::watermark() forwards unsanitized editor-controlled input to the resource locator, whose file:// scheme handler normalizes paths using only lexical '..' collapsing - never verifying containment within the media sandbox - so a crafted Markdown image directive causes the CMS to composite a traversed file into a cached image served at a public, unauthenticated URL. No public exploit has been identified at time of analysis; however, the high confidentiality impact and ease of exploitation once editor access is obtained make this a priority patch for multi-tenant Grav deployments with untrusted editors.
Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.
Privilege escalation in the Grav CMS Login plugin (grav-plugin-login) <= 3.8.11 lets a low-privilege authenticated user promote their own account to super-admin by injecting privilege fields into a profile self-update request. The flaw lives in processUserProfile() (the update_user task), which — unlike the registration handler — fails to strip 'groups' and 'access' from user-submitted form data before persisting it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but exploitation is trivial once the exposing configuration is present, and gaining super-admin unlocks admin panel access, scheduler-driven RCE, and Twig evaluation.
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages.write permission plant a malicious Class::method callable directive in page frontmatter, which Blueprint::dynamicData() feeds unfiltered into call_user_func_array(). The injected command then executes as the web-server user for any subsequent visitor to the page, including unauthenticated ones. Reported by VulnCheck (CWE-94, CVSS 4.0 base 9.3); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authorization in the Grav api plugin (grav-plugin-api) before 1.0.8 lets any authenticated panel user holding the baseline admin.login permission forge persistent API keys bound to arbitrary accounts, resulting in impersonation and privilege escalation up to account takeover. The plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks ahead of the account-management ACL, so a low-privilege operator can mint a key that inherits a higher-privileged account's API permissions. Reported by VulnCheck with a fix in 1.0.8; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Cross-origin data exposure in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 stems from a hardcoded 'Access-Control-Allow-Origin: *' header returned on every response, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin authenticates via the Authorization and X-API-Token request headers rather than cookies, any malicious website scripting a leaked access token can read the response bodies of authenticated endpoints and perform write actions as that token's user. Reported by VulnCheck with no public exploit identified at time of analysis; not listed in CISA KEV.
Sensitive token exposure in the Grav CMS API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 allows attackers to hijack valid admin sessions after JWT access tokens leak from URLs. Because JwtAuthenticator::extractBearerToken accepts tokens via the ?token= query string on every API route, those tokens are written verbatim into web server access logs, Referer headers, browser history, and upstream proxy/CDN logs, and any captured token grants full admin API access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 score of 8.2 reflects the high value of the leaked admin credentials.
Server-side request forgery in Grav CMS before 2.0.4 allows authenticated users holding the api.webhooks.write permission to register webhooks with dangerous cURL protocol handlers (file://, dict://, gopher://) that fire when webhook events trigger. By abusing these unrestricted protocols an attacker can read local files, enumerate process and service information, and pivot to internal-only network services from the trust position of the Grav server. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is driven by the CWE-918 primitive rather than confirmed in-the-wild activity.
Privilege escalation in the getgrav grav-plugin-api before 1.0.6 allows a low-privileged manager holding the api.users.write permission to become a super-admin. The createApiKey, generate2fa, and disable2fa endpoints never re-check super-admin status, so an attacker can mint API keys bound to super-admin accounts or strip 2FA from super-admin users and take over the entire Grav instance. No public exploit identified at time of analysis, but the vendor GHSA advisory and VulnCheck confirm the flaw.
Two-factor authentication bypass in Grav CMS before 2.0.4 lets an attacker who already knows a victim's password overwrite that user's TOTP secret and log in with full 2FA protection stripped away. During the pending TOTP challenge window the login plugin's regenerate2FASecret task verifies only that the user exists — not that the caller is authorized — and requires no CSRF nonce, so the attacker sets an attacker-chosen secret, computes a valid code, and completes login. VulnCheck-reported and CVSS 4.0 scored 9.1; no public exploit identified at time of analysis.
Authorization bypass in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 lets any valid API key perform actions far beyond its intended scope. Although keys can be provisioned with a restricted scopes array (e.g. read-only), the ApiKeyAuthenticator class never reads or enforces those scopes and instead returns the owning user's full account object, so a limited key can execute any write, delete, or administrative operation the owner is entitled to. Reported by VulnCheck with no public exploit identified at time of analysis, but the flaw is trivially exploitable by any key holder against default configurations.
Sensitive configuration file disclosure in Grav CMS before 2.0.4 lets unauthenticated remote attackers bypass the bundled .htaccess protections by requesting blocked file types with uppercase or mixed-case extensions (e.g., .YAML, .PHP). The shipped rules omit the Apache [NC] flag, so extension matching is case-sensitive and fails to block case variants on case-insensitive filesystems (Windows/NTFS, macOS/HFS+, Docker volume mounts), exposing files that may hold API keys and credentials. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated arbitrary file write in the Grav CMS Form plugin (versions before 9.1.8) allows attackers to plant PHP webshells in the web root by abusing the process.save.filename parameter. The filename is checked for path traversal before Twig rendering but never re-validated afterward, so traversal sequences reconstructed during template evaluation bypass the guard. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the flaw was disclosed by VulnCheck via a coordinated GitHub security advisory.
Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.
Denial of service in Grav CMS 2.0.1 lets a trusted package source or admin-level uploader bypass the newly added decompression-bomb size cap and exhaust disk space or inodes on the host. The 2.0.1 cap trusts the attacker-forgeable uncompressed size declared in each ZIP central-directory entry rather than the actual inflated stream, so a crafted archive declaring tiny sizes slips past the check while extraction writes the real, far larger payload. This is an incomplete fix for GHSA-928x-9mpw-8h56, corrected in 2.0.2; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored server-side template injection in Grav's bundled Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 lets a low-privileged content author inject Twig code through the dynamic collection/object title frontmatter, which is passed unsanitized to template_from_string() and executed. Because the title path bypasses Grav's Security::cleanDangerousTwig() filter, an attacker can reach internal Grav services such as the scheduler and escalate arbitrary Twig evaluation to full remote command execution. Reported by VulnCheck with a CVSS 4.0 base score of 8.7 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in the Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 exposes a window.__GRAV_CONFIG__ JavaScript object on the /grav/admin SPA bootstrap page and its subroutes, leaking exact Grav and Admin2 version numbers, server URL, API prefix, admin base path, and runtime environment to any unauthenticated visitor. Reported by VulnCheck, the flaw lets remote unauthenticated attackers fingerprint a deployment and pre-select version-specific exploits with zero active reconnaissance. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in grav-plugin-admin ≤ 1.10.52 allows an authenticated attacker holding admin.users permission to take over any Grav account - including the super administrator - by sending a single crafted POST request to the user-save endpoint with a data[password] field. The saveUser() method in AdminController.php verifies that the caller holds user-management rights but never compares the caller's privilege tier against the target account's, enabling silent super-admin password replacement. SSVC marks exploitation as poc-level with total technical impact; vendor-released patch is version 1.10.53.
SQL injection in the Grav CMS Database plugin (grav-plugin-database) prior to 1.2.0 lets attacker-controlled table names reach a raw SQL query. The PDO::tableExists method interpolates its table argument directly into a query with no sanitization, escaping, quoting, or whitelisting, so any consuming plugin or developer code that forwards untrusted input into that method can execute arbitrary SQL against the configured database. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2, with an attack-requirement (AT:P) reflecting the dependency on downstream code passing tainted table names.
Uncontrolled resource consumption in Grav flat-file CMS before 1.7.53 and 2.0.0-rc.8 lets a remote unauthenticated visitor crash or degrade a server by requesting on-the-fly image derivatives with absurdly large dimensions. Because Grav::fallbackUrl forwards URL query image actions such as forceResize straight to ImageMedium magic actions with no dimension or pixel ceiling, a single crafted request forces the server to allocate huge amounts of memory and CPU to build the derivative. No public exploit identified at time of analysis, but the attack is trivial and scriptable given the CVSS 4.0 VA:H, AV:N/AC:L/PR:N profile.
Denial of service in Grav CMS before 2.0.1 allows authenticated users to exhaust server storage by uploading a crafted ZIP archive (a decompression bomb) that the ZipArchiver::extract() routine expands without enforcing limits on uncompressed size, file count, or nesting depth. The CVSS 4.0 base score of 7.1 reflects a network-reachable, low-privilege flaw whose sole impact is high availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive configuration exfiltration in Grav CMS before 2.0.2 lets an authenticated page author bypass the Twig sandbox and read the full config tree, including plugin SMTP credentials, API keys, and database passwords. The flaw is an incomplete fix for the earlier GHSA-j274-39qw-32c9 sandbox escape: the redacted 'config' facade is still trivially bypassed through the allow-listed grav.offsetGet('config') call. No public exploit has been identified at time of analysis, though the bypass technique is fully described in the vendor advisory.
Arbitrary code execution in Grav CMS before 2.0.0-beta.2 stems from three distinct flaw classes: PHP object injection via unsafe unserialize() of attacker-controllable data in the Scheduler JobQueue, FileCache adapter, and Session components, an OS command injection in the plugin/theme InstallCommand git clone routine, and a Twig sandbox blocklist bypass enabling server-side template injection. An attacker who can influence the serialized input can chain available gadgets to run arbitrary PHP, while the command-injection path is reachable by authenticated administrators through plugin/theme installation. No public exploit identified at time of analysis; the issues were privately reported by VulnCheck and are fixed in 2.0.0-beta.2.
Arbitrary file disclosure in Grav CMS versions prior to 2.0.0-beta.2 allows authenticated admin-panel users to read sensitive server files via XML External Entity (XXE) injection in SVG upload processing. The flaw stems from simplexml_load_string() being called without entity-loader protections, enabling exfiltration of credentials, configuration, and environment secrets. No public exploit identified at time of analysis, though the GHSA advisory includes a working proof-of-concept payload.
Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. CVSS 7.7 (High) with confirmed scope change reflects cross-tenant impact in multi-admin environments. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.
Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.
Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
Configuration secret exposure in Grav (all versions prior to 2.0.2) allows authenticated page authors to exfiltrate sensitive plugin credentials - including SMTP passwords, API keys, and plugin database credentials - through a Twig sandbox bypass. The Grav container's offsetGet and __get methods were allow-listed, enabling page-authored Twig to obtain the raw Config object, while serialization filters (json_encode, print_r, yaml_encode, string) were not routed through GravSecurityPolicy::checkMethodAllowed, so the sandbox's member-access gate was never triggered. The vendor-released fix is confirmed in version 2.0.2; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.
Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
Scope cap bypass in the Grav API plugin before 1.0.13 allows a holder of a scoped API key issued on a super admin account to call unauthorized DemoController operations. The private requireSuper() method exits early after confirming isSuperAdmin(), never reaching requirePermission() where api_key_scopes enforcement occurs, making the scope restriction on that key inert for the baseline() and reset() endpoints. Impact is bounded to demo-engine control - forced demo resets or baseline captures - and is conditional on demo mode being actively configured with writable resources. No public exploit is identified at time of analysis.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.15 allows authenticated form authors to inject arbitrary HTML and JavaScript into radio and toggle field option labels, which then execute in the browsers of any visitor or administrator rendering that form. The root cause is Twig's |raw filter being applied to user-controlled label content, bypassing the template engine's automatic output encoding. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.1 accurately reflects the requirement for prior authentication with form-authoring privileges.