-
High 17 Sep 2026
Grav CMS vulnerable to remote code execution via .zip file upload
Fixed in 2.0.13 · CVE-2026-72819
-
High 17 Sep 2026
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
Fixed in 2.0.14 · CVE-2026-75837
-
Medium 17 Sep 2026
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
Fixed in 2.0.14 · CVE-2026-75834
-
Critical 17 Sep 2026
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Fixed in 2.0.15 · CVE-2026-75827
-
Critical 17 Sep 2026
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
Fixed in 2.0.15 · CVE-2026-75828
-
High 17 Sep 2026
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Fixed in 2.0.15 · CVE-2026-74907
-
High 17 Sep 2026
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Fixed in 2.0.16 · CVE-2026-72695
-
High 17 Sep 2026
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Fixed in 2.0.16 · CVE-2026-72697
-
High 17 Sep 2026
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Fixed in 2.0.16 · CVE-2026-76839
-
High 17 Sep 2026
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
Fixed in 2.0.16 · CVE-2026-76846
-
High 17 Sep 2026
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Fixed in 2.0.16 · CVE-2026-72698
-
Low 17 Sep 2026
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Fixed in 2.0.16 · CVE-2026-72701
-
Low 17 Sep 2026
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Fixed in 2.0.16 · CVE-2026-72702
-
Medium 17 Sep 2026
Grav: Stored XSS via Markdown audio/video media <source> URL
Fixed in 2.0.15 · CVE-2026-75831
-
Medium 17 Sep 2026
Grav: Stored XSS via quoted-attribute bypass in detectXss
Fixed in 2.0.13 · CVE-2026-72832
-
High 17 Sep 2026
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
Fixed in 2.0.11 · CVE-2026-69089
-
High 17 Sep 2026
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
Fixed in 2.0.11 · CVE-2026-69088
-
High 17 Sep 2026
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Fixed in 2.0.9 · CVE-2026-65608
-
Medium 17 Sep 2026
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer
Fixed in 2.0.2 · CVE-2026-61449
-
Medium 16 Sep 2026
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Fixed in 2.0.0 · CVE-2026-58657
-
Medium 16 Sep 2026
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
Fixed in 2.0.1 · CVE-2026-61453
-
Medium 16 Sep 2026
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Fixed in 2.0.0 · CVE-2026-59193
Check your project in one command
Composer compares your composer.lock with the public advisory databases:
composer auditIt lists every installed package with a known advisory, including getgrav/grav, and the version that fixes it.