132
CVEs
18
Critical
66
High
0
KEV
28
PoC
3
Unpatched C/H
93.9%
Patch Rate
0.8%
Avg EPSS
Severity Breakdown
CRITICAL
18
HIGH
66
MEDIUM
45
LOW
3
Monthly CVE Trend
Affected Products (16)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-66294 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27. | HIGH | 8.8 | 38.3% | 117 |
PoC
|
| CVE-2025-66301 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27. | CRITICAL | 9.6 | 31.9% | 115 |
PoC
|
| CVE-2021-47812 | GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full server compromise through admin account creation or code execution. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2025-66297 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27. | HIGH | 8.8 | 0.4% | 64 |
PoC
|
| CVE-2025-66299 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27. | HIGH | 8.8 | 0.1% | 64 |
PoC
|
| CVE-2026-64850 | Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5. | HIGH | 8.7 | 0.3% | 64 |
PoC
|
| CVE-2026-86196 | Host header injection in the Grav API plugin's forgot-password endpoint allows unauthenticated remote attackers to redirect password-reset tokens to attacker-controlled domains, enabling full account takeover including super-admin accounts. The plugin blindly incorporates the HTTP Host header when constructing reset links dispatched to victims' inboxes; an attacker who spoofs this header and induces the target to click the resulting email link captures the token and seizes the account. All Grav API plugin deployments running versions prior to 1.0.20 are affected; no public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is straightforward to execute. | HIGH | 8.7 | 0.3% | 64 |
PoC
|
| CVE-2025-66300 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. This vulnerability is fixed in 1.8.0-beta.27. | HIGH | 8.5 | 0.1% | 63 |
PoC
|
| CVE-2026-44738 | Information disclosure in Grav CMS versions prior to 2.0.0-rc.2 allows authenticated users with admin.pages role to extract all site configuration secrets via Twig sandbox bypass. Attackers can invoke config.toArray() from page content to dump SMTP passwords, AWS keys, OAuth client secrets, and API tokens into rendered HTML. CVSS 7.7 (High) with confirmed scope change reflects cross-tenant impact in multi-admin environments. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. | HIGH | 7.7 | 0.0% | 59 |
PoC
|
| CVE-2025-66298 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-62669 | Two-factor authentication bypass in Grav Login Plugin prior to 3.8.11 allows an attacker who possesses a victim's password to completely circumvent TOTP enforcement. By invoking the taskRegenerate2FASecret() endpoint during the pending login window - when the session exists but is not yet authorized - the attacker overwrites the victim's 2FA secret, reads the replacement from the server response, computes a valid code, and completes authentication without the victim's physical device. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the attack primitive is explicitly confirmed by vendor advisory GHSA-7mgc-c7pq-3rr3 and the commit diff. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2025-66302 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory. The impact of this vulnerability depends on the privileges of the user account running the application. This vulnerability is fixed in 1.8.0-beta.27. | MEDIUM | 6.8 | 0.1% | 54 |
PoC
|
| CVE-2026-61690 | Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026). | MEDIUM | 6.5 | 0.4% | 53 |
PoC
|
| CVE-2026-61842 | Configuration secret exposure in Grav (all versions prior to 2.0.2) allows authenticated page authors to exfiltrate sensitive plugin credentials - including SMTP passwords, API keys, and plugin database credentials - through a Twig sandbox bypass. The Grav container's offsetGet and __get methods were allow-listed, enabling page-authored Twig to obtain the raw Config object, while serialization filters (json_encode, print_r, yaml_encode, string) were not routed through GravSecurityPolicy::checkMethodAllowed, so the sandbox's member-access gate was never triggered. The vendor-released fix is confirmed in version 2.0.2; no public exploit code or CISA KEV listing is confirmed at time of analysis. | MEDIUM | 6.5 | 0.3% | 53 |
PoC
|
| CVE-2025-66307 | A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available. | MEDIUM | 6.5 | 0.1% | 53 |
PoC
|