Grav CMS versions before 2.0.16 have a path traversal vulnerability in the media_directory() Twig function. This flaw allows authenticated users with page authoring privileges to supply arbitrary filesystem paths and read files outside the intended directory scope, limited to files matching configured media extensions accessible by the web server process.
Grav CMS versions before 2.0.16 have a vulnerability in the Scheduler component where symlink following is improperly handled during lock file creation. This allows local attackers to create symbolic links at predictable lock file paths in a world-writable temporary directory, causing the scheduled job to overwrite arbitrary files writable by the web server process with the job ID string.
Grav versions before 2.0.16 have a path traversal vulnerability in the MediaUploadTrait::deleteFile() function. Authenticated users with media management permissions can delete arbitrary files outside the intended media directory by using directory traversal sequences in filenames. The vulnerability arises because only the basename of the filename is validated, while directory paths containing '../' sequences are not properly checked before being passed to the unlink() function.
Grav Login plugin versions before 1.0.16 contain an authorization flaw in the onApiUserListRowAction unlock handler. This flaw allows an attacker with api.users.write permission to reset login lockout counters on admin.super accounts, effectively removing brute-force protection from these high-privilege accounts without needing equivalent permissions.
Grav versions prior to 3.9.2 contain a vulnerability in the sendInvitationEmail() function where untrusted Host headers are not properly validated. This allows attackers to manipulate the Host header to create invitation links that redirect users to attacker-controlled domains. The require_trusted_host protection only applies to password reset flows and does not mitigate this issue for invitation links.
CVE-2026-56708 is a server-side request forgery (SSRF) vulnerability in the Grav API plugin before version 1.0.16. It arises from a time-of-check to time-of-use (TOCTOU) race condition in webhook delivery, allowing attackers to bypass hostname validation via DNS rebinding. This enables attackers controlling the DNS for a webhook hostname to manipulate validation and delivery lookups to access internal network resources.
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 have an authorization bypass vulnerability in the flex-objects shortcode. This flaw allows users with page-edit access to render any registered Flex collection without proper permission checks. Attackers can exploit this by placing the shortcode in published pages, potentially exposing sensitive directory contents such as user account information. The vulnerability bypasses the authorization ACL enforced in the admin panel.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
CVE-2026-63407 is a high-severity vulnerability in the Grav API Plugin for Grav CMS. Prior to version 1.0.0-rc.16, the plugin's CORS middleware allowed any origin to access authenticated API endpoints by returning Access-Control-Allow-Origin: *. This permissive cross-domain policy enables JavaScript from any origin to submit attacker-obtained JWT tokens and perform actions with the token owner's privileges, including reading data and modifying accounts. The issue is fixed in version 1.0.0-rc.16.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Grav versions prior to 2.0.4 have a vulnerability due to improper handling of case sensitivity in Apache .htaccess security rules. The rules omit the Apache [NC] flag, causing case-sensitive matching of directory and file-extension patterns. On case-insensitive filesystems, this allows unauthenticated attackers to bypass restrictions by using uppercase variants of directory or file extensions, potentially exposing sensitive files such as password hashes and security configurations. This issue is fixed in Grav version 2.0.4.
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
CVE-2026-62667 is a missing authorization vulnerability in the Grav API Plugin for Grav CMS versions prior to 1.0.6. The flaw allows an API key issued with limited scopes to bypass scope restrictions and perform all actions available to the owning user, including write, delete, and administrative operations. This occurs because the authentication process does not properly enforce declared scopes, leading to excessive permissions. The issue is fixed in version 1.0.6.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.
A vulnerability in Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings. The issue is fixed in version 1.0.6.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.