Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.
CVE-2026-61690 is a vulnerability in the Grav file-based web platform prior to version 2.0.1. The issue arises from improper handling of highly compressed ZIP archives in the ZipArchiver::extract() function, which does not enforce limits on uncompressed size, file count, or nesting depth. This can lead to resource exhaustion such as disk space or inode depletion, causing site unavailability. The vulnerability is fixed in Grav version 2.0.1.
CVE-2026-61607 is a cross-site scripting (XSS) vulnerability in the Grav API Plugin for Grav CMS. Versions prior to 1.0.2 do not properly sanitize SVG files uploaded via the POST /api/v1/media endpoint, allowing attackers with api.media.write permission to upload SVGs containing malicious JavaScript. When these SVG files are served with the image/svg+xml content type, the embedded script executes in the victim's browser, potentially leading to session data theft and unauthorized actions. This vulnerability is fixed in version 1.0.2.
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
CVE-2026-75837 is a critical improper privilege management vulnerability in Grav CMS versions before 2.0.14. It allows a delegated admin.users operator to escalate privileges to super-admin by modifying the access field without proper security restrictions. This escalation grants scheduler and Twig evaluation capabilities, potentially leading to full administrative control.
CVE-2026-75836 is a high-severity vulnerability in the Grav API plugin before version 1.0.14. It involves missing authorization checks in the MenubarController::executeAction() method, allowing authenticated users with basic API access to invoke privileged menubar actions without proper authorization. While the GET menubar items endpoint enforces authorization correctly, the POST endpoint for menubar actions does not evaluate the required authorization field. This flaw currently has latent impact on stock Grav installations as no core plugins register privileged authorize handlers, but it affects any plugins relying on the documented authorization semantics.
CVE-2026-75835 is a critical missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) versions before 1.0.14. The flaw exists in the userPassesAuthorize() function, which improperly authorizes requests by ignoring API key scopes and relying solely on the super-admin flag and ACL grants. This allows an authenticated attacker with a scoped API key from a privileged account to bypass scope restrictions and access UI metadata and item definitions that should be restricted, leading to information disclosure.
Grav versions before 2.0.14 contain a stored cross-site scripting (XSS) vulnerability in the Security::detectXss() function. This flaw allows an authenticated user with page-edit permissions to inject malicious JavaScript that executes in the browsers of visitors viewing the affected page. The vulnerability arises because invalid UTF-8 bytes cause the XSS detection patterns to fail silently, bypassing the save-time XSS safety checks.
CVE-2026-75833 is an open redirect vulnerability in the Grav API plugin's SsoController::sanitizeReturnTo() function before version 1.0.14. The function attempts to block URLs with a '//' prefix but fails to handle browser normalization of backslashes to slashes, allowing crafted returnTo parameters like '/\evil.com' to redirect users to attacker-controlled sites after OAuth login. This can enable post-login phishing attacks. Exploitability depends on the client-side OAuth callback handler and was not independently verified.
CVE-2026-75832 is a critical missing authorization vulnerability in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.15. The flaw exists in the BlueprintPathResolver::resolveUserScope() method, which incorrectly authorizes access based on the super-admin ACL flag of the account rather than the actual API key scope. This allows an attacker with an API key scoped only to api.media.write but minted on a super-admin account to write files into another user's scope and browse that user's file listings, despite lacking explicit api.users.write permissions.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the audio and video media rendering functionality. This occurs because the media URL fragment is concatenated without proper escaping into raw HTML source elements, allowing attackers to inject arbitrary HTML and JavaScript that execute in the context of users' sessions.
A path traversal vulnerability exists in grav-plugin-api versions from 0 up to 1.0.14 in the PagesController::batchCopy() method. Authenticated users with editor-level permissions can exploit this flaw by supplying crafted path traversal sequences in the 'suffix' parameter to write arbitrary files outside the intended directory. This vulnerability allows unauthorized file writes to locations writable by the web server. The issue is fixed in version 1.0.15.
CVE-2026-75829 is a high-severity vulnerability in the grav-plugin-api component of the getgrav grav CMS. Versions before 1.0.15 do not properly validate Twig template content submitted via the translate() endpoint. This allows attackers with api.pages.write permission to inject server-side template code that is executed when the page is rendered.
Grav versions before 2.0.15 contain a stored cross-site scripting (XSS) vulnerability in the detectXss() function. This flaw allows authenticated editors to inject event handlers such as onerror= that bypass validation due to improper neutralization of unpaired quotes in unquoted attribute values. When page content is rendered, these injected event handlers execute in visitor browsers, potentially leading to high-impact XSS attacks.
Grav versions before 2.0.15 have a critical vulnerability allowing attackers with page-edit or blueprint-config access to perform arbitrary file writes via an incomplete denylist in the Blueprint dynamic-data validation. This can lead to remote code execution by appending PHP payloads to web-accessible files through the error_log function.
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
CVE-2026-74908 is a cross-site scripting (XSS) vulnerability in the Grav plugin-api before version 1.0.15. The issue arises because the SVG sanitizer only validates files with the exact '.svg' extension, allowing files with '.svgz' and '.xhtml' extensions to bypass sanitization. Attackers with api.media.write permission can upload malicious files containing executable scripts that run in the context of the site when accessed by administrators or visitors.
Grav versions before 2.0.15 have a path traversal vulnerability in the static asset server within index.php. The vulnerability arises from improper pathname limitation using string prefix matching rather than proper directory-boundary validation. This allows unauthenticated attackers to access files in sibling directories by exploiting directory names that extend the base path string.
The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.