Getgrav/grav

This hub aggregates every CVE we track for Getgrav/grav, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Getgrav/grav.

• GHSA-8hgv-xc77-jmcrGrav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-adminAug 21, 2026
• CVE-2026-11430Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit7.3Aug 7, 2026
• GHSA-3446-6mgw-f79pGrav is Vulnerable to XXE via SVG Upload May 5, 2026
• GHSA-gwfr-jfjf-92vvGrav has Insecure Deserialization in File CacheMay 5, 2026
• GHSA-vj3m-2g9h-vm4pGrav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypassMay 5, 2026
• CVE-2025-66844In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be ...9.1Dec 15, 2025
• CVE-2025-66843grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject...5.4Dec 15, 2025
• CVE-2025-65186Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> ta...6.1Dec 2, 2025
• CVE-2025-66312Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`5.4Dec 1, 2025
• CVE-2025-66311Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters5.4Dec 1, 2025
• CVE-2025-66310Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab5.4Dec 1, 2025
• CVE-2025-66309Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab6.1Dec 1, 2025
• CVE-2025-66308Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`5.4Dec 1, 2025
• CVE-2025-66307Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure6.5Dec 1, 2025
• CVE-2025-66306Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel4.3Dec 1, 2025