Grav CMS versions before 2.0.16 contain a vulnerability that allows content editors with page-content edit access to read sensitive configuration data. This occurs because the system, site, and theme configuration arrays are not properly filtered in sandboxed Twig renders, enabling unauthorized access to secrets such as cache credentials via dot notation in Twig templates. The vulnerability bypasses config_denied_paths restrictions.
Grav CMS versions before 2.0.16 have a path traversal vulnerability in the media_directory() Twig function. This flaw allows authenticated users with page authoring privileges to supply arbitrary filesystem paths and read files outside the intended directory scope, limited to files matching configured media extensions accessible by the web server process.
Grav versions before 2.0.16 have a path traversal vulnerability in the MediaUploadTrait::deleteFile() function. Authenticated users with media management permissions can delete arbitrary files outside the intended media directory by using directory traversal sequences in filenames. The vulnerability arises because only the basename of the filename is validated, while directory paths containing '../' sequences are not properly checked before being passed to the unlink() function.
Grav versions prior to 3.9.2 contain a vulnerability in the sendInvitationEmail() function where untrusted Host headers are not properly validated. This allows attackers to manipulate the Host header to create invitation links that redirect users to attacker-controlled domains. The require_trusted_host protection only applies to password reset flows and does not mitigate this issue for invitation links.
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Grav versions prior to 2.0.4 have a vulnerability due to improper handling of case sensitivity in Apache .htaccess security rules. The rules omit the Apache [NC] flag, causing case-sensitive matching of directory and file-extension patterns. On case-insensitive filesystems, this allows unauthenticated attackers to bypass restrictions by using uppercase variants of directory or file extensions, potentially exposing sensitive files such as password hashes and security configurations. This issue is fixed in Grav version 2.0.4.
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.
CVE-2026-61690 is a vulnerability in the Grav file-based web platform prior to version 2.0.1. The issue arises from improper handling of highly compressed ZIP archives in the ZipArchiver::extract() function, which does not enforce limits on uncompressed size, file count, or nesting depth. This can lead to resource exhaustion such as disk space or inode depletion, causing site unavailability. The vulnerability is fixed in Grav version 2.0.1.
CVE-2026-75837 is a critical improper privilege management vulnerability in Grav CMS versions before 2.0.14. It allows a delegated admin.users operator to escalate privileges to super-admin by modifying the access field without proper security restrictions. This escalation grants scheduler and Twig evaluation capabilities, potentially leading to full administrative control.
Grav versions before 2.0.14 contain a stored cross-site scripting (XSS) vulnerability in the Security::detectXss() function. This flaw allows an authenticated user with page-edit permissions to inject malicious JavaScript that executes in the browsers of visitors viewing the affected page. The vulnerability arises because invalid UTF-8 bytes cause the XSS detection patterns to fail silently, bypassing the save-time XSS safety checks.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the audio and video media rendering functionality. This occurs because the media URL fragment is concatenated without proper escaping into raw HTML source elements, allowing attackers to inject arbitrary HTML and JavaScript that execute in the context of users' sessions.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the detectXss() function. This flaw allows authenticated editors to inject event handlers such as onerror= that bypass validation due to improper neutralization of unpaired quotes in unquoted attribute values. When page content is rendered, these injected event handlers execute in visitor browsers, potentially leading to high-impact XSS attacks.
Grav versions before 2.0.15 have a critical vulnerability allowing attackers with page-edit or blueprint-config access to perform arbitrary file writes via an incomplete denylist in the Blueprint dynamic-data validation. This can lead to remote code execution by appending PHP payloads to web-accessible files through the error_log function.
Grav versions before 2.0.15 have a path traversal vulnerability in the static asset server within index.php. The vulnerability arises from improper pathname limitation using string prefix matching rather than proper directory-boundary validation. This allows unauthenticated attackers to access files in sibling directories by exploiting directory names that extend the base path string.
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler.custom_jobs, which Job::run() passes to a Symfony Process, achieving operating system command execution as the web server user.
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.
Grav versions before 2.0.13 contain a path traversal vulnerability in the backup profile root path validation. This flaw allows attackers with profile editor access to configure backup profiles that archive directories outside the intended GRAV_ROOT directory, potentially exposing sensitive files from system locations such as /opt, /mnt, or /srv. The vulnerability arises because the validation does not properly restrict paths not included in a hard-coded deny-list.