Grav versions from 2.0.15 up to but not including 2.2.13 contain a vulnerability that allows attackers with page-edit permissions to bypass allowlist restrictions and invoke arbitrary public static methods. This can lead to unauthorized deletion of directories, overwriting of files, or reading files outside the intended page tree by embedding crafted fields in Flex form overrides within page frontmatter.
Grav versions from 2.0.0 up to but not including 2.2.5 contain an improper access control vulnerability in the FlexDirectory::dynamicFlexField() function. This flaw allows page authors to invoke arbitrary Flex object methods through flex-*@ directives in page frontmatter. When a user with page edit permissions opens such a page, certain directives like setStorageKey() and delete() execute in their session, potentially deleting protected pages that should not be deletable by either account.
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticated non-super users with api.access and admin.pages or admin.configuration.pages permissions can read page source and frontmatter, modify content, or delete pages they are denied.
The Grav Login plugin versions from 3.6.0 up to but not including 3.9.13 contains a missing authorization vulnerability in the login.invite task. This flaw allows unauthenticated attackers to create invitation forms in page frontmatter that grant super user access. By submitting such a form, attackers can register an invited address with full site control, effectively escalating privileges to super user.
Grav versions from 2.0.0 up to but not including 2.2.5 contain an information disclosure vulnerability. This flaw allows page authors to capture visitors' HTTP Basic authentication credentials by embedding them in Twig page content. Specifically, authors can print the request URI object, which includes PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image, potentially exfiltrating administrator credentials to an external host.
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.
Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
Grav versions before 2.1.7 have an information disclosure vulnerability where nested .git directories are not properly blocked by default web server configurations. This allows unauthenticated attackers to access Git repository data such as config files, refs, and objects, potentially exposing unpublished history or secrets.
Grav versions from 2.0.22 up to but not including 2.1.7 have an authentication bypass vulnerability in the Clockwork profiler component. This flaw allows unauthenticated attackers behind a same-host HTTP proxy to access profiler records, which may expose sensitive system and plugin configuration details, secrets, request metadata, and queries. The vulnerability arises because the profiler trusts loopback REMOTE_ADDR values, enabling unauthorized information disclosure.
Grav versions before 2.1.7 have a denial of service vulnerability where authenticated media authors can upload highly compressed oversized raster images. This causes memory exhaustion when the images are processed without dimension checks, leading to page unavailability for anonymous users.
Grav Star Ratings versions 2.0.1 through 2.0.3 have a missing authorization vulnerability that allows unauthenticated users to submit votes by bypassing client-side vote access controls. This enables attackers to manipulate restricted or disabled ratings and affect the aggregate rating output.
The Grav Guestbook plugin versions before 0.5.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because the plugin's AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML using jQuery. Unauthenticated users can submit malicious markup that executes in the browsers of other visitors. In versions 0.5.0 and 0.5.1, this vulnerability also affects administrator moderation sessions.
The Grav Login OAuth plugin before version 1.4.3 uses weak credential generation by creating usernames deterministically and passwords as unsalted MD5 hashes of provider identifiers. This allows unauthenticated remote attackers who can guess or learn a provider identifier to reproduce credentials and log in as privileged users, potentially gaining administrative control.
The Grav API plugin (grav-plugin-api) before version 1.0.36 has a vulnerability where session validation is insufficient. Disabled user accounts can continue to access API endpoints by reusing existing authorized sessions, as the SessionAuthenticator does not check account state. This allows disabled users to bypass operator revocation until their sessions expire.
The Grav Guestbook plugin versions 0.5.0 and 0.5.1 have missing authorization and cross-site request forgery (CSRF) vulnerabilities affecting Admin moderation actions such as delete, approve, and approveAll. Authenticated Admin users without the required admin.guestbook permission, or external sites exploiting a moderator's session via nonce-less GET requests, can perform unauthorized deletions or approvals of Guestbook entries.
Grav grav-plugin-api versions before 1.0.36 contain a privilege escalation vulnerability that allows delegated user managers to gain super-admin access. This occurs when positive scalar admin or API parent grants are stored, enabling attackers with api.users.write permission to manipulate account access maps or invitations. This manipulation causes the permission resolver to satisfy requireSuper checks, granting access to super-admin-only API endpoints.
The Grav Data Manager plugin versions 1.4.0 through 1.4.5 have a missing authorization vulnerability. This flaw allows unauthenticated attackers to delete stored data files under user/data/ by sending requests with specific parameters. The vulnerability also enables attackers to bypass CSRF nonce checks, increasing the risk of unauthorized data deletion.
Grav versions from 2.0.22 up to but not including 2.1.7 have an information disclosure vulnerability. This flaw allows page editors to access the Clockwork debugger token due to an omission in the sandbox redaction list. Attackers can exploit this by rendering the token via editor-authored Twig templates and use it to read profiler records containing sensitive configuration, request metadata, and database queries.