CVE-2026-56708 is a server-side request forgery (SSRF) vulnerability in the Grav API plugin before version 1.0.16. It arises from a time-of-check to time-of-use (TOCTOU) race condition in webhook delivery, allowing attackers to bypass hostname validation via DNS rebinding. This enables attackers controlling the DNS for a webhook hostname to manipulate validation and delivery lookups to access internal network resources.
Grav Flex Objects plugin versions 1.4.0 through 1.4.7 have an authorization bypass vulnerability in the flex-objects shortcode. This flaw allows users with page-edit access to render any registered Flex collection without proper permission checks. Attackers can exploit this by placing the shortcode in published pages, potentially exposing sensitive directory contents such as user account information. The vulnerability bypasses the authorization ACL enforced in the admin panel.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.
CVE-2026-63407 is a high-severity vulnerability in the Grav API Plugin for Grav CMS. Prior to version 1.0.0-rc.16, the plugin's CORS middleware allowed any origin to access authenticated API endpoints by returning Access-Control-Allow-Origin: *. This permissive cross-domain policy enables JavaScript from any origin to submit attacker-obtained JWT tokens and perform actions with the token owner's privileges, including reading data and modifying accounts. The issue is fixed in version 1.0.0-rc.16.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServiceProvider task: URI parameter without requiring a login-form nonce, an Origin check, or a Referer check. Under the default SameSite=Lax session cookie policy, an off-site navigation can invoke taskRegenerate2FASecret() in a logged-in victim's session, overwrite the victim's TOTP secret, and force two-factor re-enrollment. This issue is fixed in version 3.8.11.
Grav versions prior to 2.0.4 have a vulnerability due to improper handling of case sensitivity in Apache .htaccess security rules. The rules omit the Apache [NC] flag, causing case-sensitive matching of directory and file-extension patterns. On case-insensitive filesystems, this allows unauthenticated attackers to bypass restrictions by using uppercase variants of directory or file extensions, potentially exposing sensitive files such as password hashes and security configurations. This issue is fixed in Grav version 2.0.4.
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
CVE-2026-62667 is a missing authorization vulnerability in the Grav API Plugin for Grav CMS versions prior to 1.0.6. The flaw allows an API key issued with limited scopes to bypass scope restrictions and perform all actions available to the owning user, including write, delete, and administrative operations. This occurs because the authentication process does not properly enforce declared scopes, leading to excessive permissions. The issue is fixed in version 1.0.6.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.
A vulnerability in Grav API Plugin prior to version 1.0.6 allows a non-super user with api.users.write permission to create an API key with super-administrator privileges. This occurs because certain user mutation endpoints omit a critical access check, enabling unauthorized privilege escalation and manipulation of two-factor authentication settings. The issue is fixed in version 1.0.6.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.
Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.
CVE-2026-61690 is a vulnerability in the Grav file-based web platform prior to version 2.0.1. The issue arises from improper handling of highly compressed ZIP archives in the ZipArchiver::extract() function, which does not enforce limits on uncompressed size, file count, or nesting depth. This can lead to resource exhaustion such as disk space or inode depletion, causing site unavailability. The vulnerability is fixed in Grav version 2.0.1.
CVE-2026-61607 is a cross-site scripting (XSS) vulnerability in the Grav API Plugin for Grav CMS. Versions prior to 1.0.2 do not properly sanitize SVG files uploaded via the POST /api/v1/media endpoint, allowing attackers with api.media.write permission to upload SVGs containing malicious JavaScript. When these SVG files are served with the image/svg+xml content type, the embedded script executes in the victim's browser, potentially leading to session data theft and unauthorized actions. This vulnerability is fixed in version 1.0.2.
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
CVE-2026-75837 is a critical improper privilege management vulnerability in Grav CMS versions before 2.0.14. It allows a delegated admin.users operator to escalate privileges to super-admin by modifying the access field without proper security restrictions. This escalation grants scheduler and Twig evaluation capabilities, potentially leading to full administrative control.