Description Summary:
Grav CMS before 2.0.19 is vulnerable to remote code execution via the Twig sort filter due to an improper sandbox configuration that allows unauthorized access to the spl_autoload function.

Executive Summary:
Grav CMS versions prior to 2.0.19 contain a critical remote code execution vulnerability that allows authenticated users with page-write access to execute arbitrary PHP code.

Vulnerability Details

CVE-ID: CVE-2026-85604

Affected Software: Grav Grav CMS

Affected Versions: 0 up to (excluding) 2.0.19

Vulnerability: The vulnerability exists in the Twig sort filter where the sortFunc wrapper incorrectly disables sandboxing. This allows an authenticated user with page-write privileges to invoke the spl_autoload function, which can be leveraged to trigger arbitrary PHP code execution on the server.

Business Impact

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code with the permissions of the web server user. This level of access typically results in a total compromise of the application, potential data exfiltration, and the ability to pivot into the underlying server infrastructure. With a CVSS score of 8.8, this flaw represents a high-risk security event that requires immediate attention to prevent full system takeover.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.19 or later immediately to apply the necessary security patches and restrict the Twig sort filter functionality.

Proactive Monitoring: Review web server and application logs for suspicious entries involving Twig filter usage or unexpected file inclusion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block malicious payloads targeting PHP template engines or anomalous input in form frontmatter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 5, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the flaw allows for significant impact, the requirement for authenticated page-write access serves as a partial barrier to entry.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a severe threat to the integrity and availability of the Grav CMS environment. Administrators must prioritize updating to version 2.0.19 as soon as possible to neutralize the risk of arbitrary code execution. Continuous monitoring of administrative actions and application logs is advised until the update is fully deployed across all instances.

Description Summary:
The Grav API plugin fails to properly validate API key scopes within its user management endpoints, allowing restricted API keys to perform unauthorized administrative actions against super-admin accounts.

Executive Summary:
A critical authorization bypass vulnerability in the Grav API plugin allows attackers with restricted API keys to perform unauthorized administrative actions, including the compromise of super-admin accounts.

Vulnerability Details

CVE-ID: CVE-2026-80203

Affected Software: GetGrav Grav

Affected Versions: 0 up to (excluding) 1.0.18

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) within the UsersController.php file. The requireNotSuperTarget function fails to verify if an API key possesses the required scope, instead relying on an insufficient check of the account status, which allows unauthenticated attackers (possessing a scoped key) to manipulate sensitive administrative settings.

Business Impact

The ability for an attacker to disable 2FA, delete avatars, or manage API keys for super-admin accounts poses a severe threat to the integrity and security of the Grav instance. Given the CVSS score of 9.8, this vulnerability allows for total administrative account takeover, which could lead to full system compromise, unauthorized data access, and significant reputational damage.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.18 or later immediately to resolve the authorization logic flaw.

Proactive Monitoring: Review web server and application access logs for unusual patterns of API calls directed at user management endpoints, particularly those attempting to modify security settings or API key configurations.

Compensating Controls: Implement strict API key management policies and restrict the exposure of administrative endpoints at the network perimeter, utilizing a Web Application Firewall (WAF) to block suspicious requests targeting the UsersController.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the reliance on improper scope validation, which effectively bypasses intended security boundaries for administrative identities.

Analyst Recommendation

This vulnerability represents a critical risk to any Grav installation utilizing the API plugin. Security teams should prioritize patching to version 1.0.18 as the primary defense, as there are no effective workarounds that maintain full functionality while securing the vulnerable endpoints. Failure to remediate could result in a complete loss of control over administrative access to the platform.

Description Summary:
Grav contains an information disclosure vulnerability in the Twig sandbox configuration due to an incomplete denylist, allowing attackers to retrieve sensitive system configuration secrets.

Executive Summary:
An information disclosure vulnerability in Grav versions before 2.0.16 allows unauthorized retrieval of sensitive system configuration secrets via the Twig sandbox.

Vulnerability Details

CVE-ID: CVE-2026-76846

Affected Software: Grav Grav

Affected Versions: 0 up to (excluding) 2.0.16

Vulnerability: This vulnerability involves an incomplete default denylist in the Twig sandbox configuration, which fails to block access to system secrets. Attackers with page-edit permissions can leverage the config.get() or config.toArray() methods within Twig templates to access sensitive data, including Redis passwords, when the config_access feature is enabled.

Business Impact

Successful exploitation leads to the exposure of sensitive configuration data, which could include database credentials or cache service passwords. This unauthorized access compromises the confidentiality of the application environment and may facilitate further attacks, such as database compromise. The CVSS score of 7.5 reflects the significant risk posed by this high-impact information disclosure.

Remediation Plan

Immediate Action: Update Grav to version 2.0.16 or later immediately to apply the corrected Twig sandbox denylist.

Proactive Monitoring: Review application logs for suspicious usage of Twig templates or unauthorized calls to configuration retrieval methods.

Compensating Controls: Ensure that the config_access feature is disabled if not strictly required for site operations, and restrict page-edit permissions to trusted administrative users.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows direct access to system secrets via the template engine.

Analyst Recommendation

This vulnerability presents a clear risk to sensitive environment variables and credentials. Administrators should prioritize updating to version 2.0.16 as soon as possible to prevent potential unauthorized disclosure of system secrets.

Description Summary:
The Grav Email plugin is susceptible to a template injection vulnerability, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A template injection flaw within the Grav Email plugin enables authenticated attackers to perform remote code execution, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-75574

Affected Software: getgrav Grav Email plugin

Affected Versions: 0 up to (excluding) 4.2.2

Vulnerability: This vulnerability (CWE-1336) involves improper neutralization of special elements within the Twig template engine. An attacker with low-level privileges (PR:L) can manipulate template processing to execute unauthorized commands on the server.

Business Impact

The ability to execute arbitrary code on the server represents a critical security failure, potentially leading to full system compromise, data theft, or complete service disruption. With a CVSS score of 8.8, this high-severity vulnerability allows an authenticated attacker to move beyond application-level access to the underlying operating system environment.

Remediation Plan

Immediate Action: Update the Grav Email plugin to version 4.2.2 or later to address the template injection flaw.

Proactive Monitoring: Inspect server logs for anomalous execution patterns or unexpected system calls originating from the web application process.

Compensating Controls: Ensure that the application is running with the principle of least privilege, limiting the permissions of the web server user to minimize the potential impact of a successful code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of template injection makes the application highly susceptible to payload delivery if the input is not strictly sanitized.

Analyst Recommendation

Given the potential for remote code execution, this issue requires immediate attention from security teams. Organizations should verify their current version of the Grav Email plugin and apply the 4.2.2 update to prevent unauthorized code execution.

Description Summary:
The Grav API plugin is vulnerable to improper privilege management, allowing authenticated users to escalate privileges via scoped API keys.

Executive Summary:
A privilege escalation vulnerability in the Grav API plugin permits authenticated attackers to gain elevated system access, posing a high security risk.

Vulnerability Details

CVE-ID: CVE-2026-72833

Affected Software: getgrav Grav

Affected Versions: Versions prior to 1.0.6

Vulnerability: This vulnerability involves improper privilege management (CWE-269) within the Grav API plugin. An attacker with low-level authenticated access can manipulate scoped API keys to perform actions beyond their authorized permission set.

Business Impact

Successful exploitation of this flaw allows a malicious actor to compromise the integrity and availability of the Grav CMS environment. Given the high CVSS score of 8.8, this vulnerability represents a significant risk to organizational data, as it grants unauthorized administrative-level capabilities to standard users.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.6 or later to resolve the privilege management flaw.

Proactive Monitoring: Review access logs for unusual API activity or unexpected administrative actions performed by low-privileged user accounts.

Compensating Controls: Implement strict access control lists for API key generation and restrict usage to necessary network segments until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete control over the CMS application once privileges are escalated.

Analyst Recommendation

Administrators should prioritize patching the Grav API plugin immediately to prevent potential unauthorized escalation. Ensure all API keys are audited and revoked if suspicious activity is detected during the update process.

Description Summary:
The Flex Objects plugin in Grav is vulnerable to an authorization bypass, allowing authenticated low privilege users to perform unauthorized actions.

Executive Summary:
A high severity authorization bypass vulnerability in the Grav Flex Objects plugin allows authenticated attackers to perform unauthorized operations, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72831

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.4.7, 2.0.11

Vulnerability: This vulnerability is caused by an incorrect authorization check (CWE-863) within the Flex Objects plugin. An authenticated user with low privileges can bypass intended access controls to interact with restricted functions.

Business Impact

Successful exploitation of this flaw could allow an attacker to gain unauthorized access to data or administrative functions within the Grav environment. Given the high CVSS score of 8.8, this poses a significant risk to the integrity and confidentiality of the content management system, potentially resulting in unauthorized administrative control.

Remediation Plan

Immediate Action: Update the Grav installation and the Flex Objects plugin to version 1.4.7 or later to address the authorization flaw.

Proactive Monitoring: Review application access logs for unusual patterns of interaction with the Flex Objects plugin or unauthorized attempts to access administrative endpoints.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter requests targeting the Flex Objects plugin functionality until updates are applied.

Exploitation Status

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Analyst Notes: As of August 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an access control failure that requires an existing authenticated session to trigger.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators must prioritize updating the Grav core and associated plugins to the specified fixed versions to prevent potential unauthorized administrative access.

Description Summary:
The Grav API plugin fails to enforce API key scopes in the ConfigController, allowing attackers to inject and execute arbitrary OS commands via the scheduler configuration.

Executive Summary:
A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to achieve remote code execution through command injection.

Vulnerability Details

CVE-ID: CVE-2026-72830

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.0.13

Vulnerability: The vulnerability stems from improper privilege management within the ConfigController. Unauthenticated attackers can leverage scoped API keys to modify scheduler jobs, resulting in arbitrary OS command execution.

Business Impact

This flaw permits full remote code execution, which allows an attacker to compromise the underlying operating system. The ability to execute arbitrary commands poses a severe threat to business operations, data privacy, and overall infrastructure security. The CVSS score of 9.8 reflects the high potential for total system compromise.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.13 or later to enforce proper scope validation.

Proactive Monitoring: Audit scheduler configuration files for unauthorized or unexpected job entries.

Compensating Controls: Use a Web Application Firewall to inspect and block suspicious API calls targeting configuration endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous as it allows for direct command injection on the host system.

Analyst Recommendation

Given the critical nature of this vulnerability, immediate remediation is required. Security teams should verify that all Grav instances are updated to version 1.0.13 or higher to prevent potential exploitation.

Description Summary:
The Grav API plugin contains a flaw in UsersController that allows attackers to bypass scope caps and promote accounts to super-user status.

Executive Summary:
A critical privilege management flaw in the Grav API plugin enables unauthenticated attackers to promote accounts to super-user status, leading to total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72829

Affected Software: getgrav Grav

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: This is an improper privilege management vulnerability (CWE-269) where the system performs an insufficient check on administrative grants. The application fails to verify the API key scopes before allowing promotion to super-user privileges.

Business Impact

The ability to elevate any account to super-user status grants an attacker full control over the application. With a CVSS score of 9.8, this vulnerability allows for data exfiltration, administrative manipulation, and potential persistence mechanisms that threaten the entire business operation.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Review user account lists for unauthorized administrative accounts and monitor API usage logs for unusual promotion activities.

Compensating Controls: Utilize a WAF to block unauthorized API requests and enforce the principle of least privilege by auditing existing API key capabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the bypass of critical authorization gates.

Analyst Recommendation

Given the availability of a proof-of-concept and the critical nature of the vulnerability, immediate patching is required. Administrators should verify all current user accounts for signs of unauthorized promotion following the update.

Description Summary:
An improper privilege management vulnerability in the getgrav grav-plugin-api allows high-privileged users to bypass API key scopes via the InvitationsController.

Executive Summary:
An improper privilege management flaw in the getgrav grav-plugin-api could allow administrative users to bypass critical security scopes.

Vulnerability Details

CVE-ID: CVE-2026-72828

Affected Software: getgrav grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability, classified as CWE-269, involves improper privilege management within the InvitationsController. The vulnerability requires an attacker to already possess high privileges, which they then use to bypass intended API key scope restrictions.

Business Impact

The CVSS score of 7.2 highlights the potential for severe impact on system confidentiality, integrity, and availability. By bypassing scope restrictions, an authenticated administrator could gain unauthorized access to data or functions outside their assigned permissions, potentially leading to a total compromise of the application environment.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later to address the underlying privilege management flaw.

Proactive Monitoring: Audit logs for any irregular administrative activity or attempts to access administrative functions that fall outside of defined API key scopes.

Compensating Controls: Regularly review and rotate API keys, and enforce the principle of least privilege for all administrative accounts to minimize the potential impact of a scope bypass.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high privileges, the ability to bypass scope restrictions remains a significant security concern for enterprise environments.

Analyst Recommendation

While this vulnerability requires high-privileged access, it represents a significant failure in security architecture. Organizations must prioritize upgrading to version 1.0.13 to restore proper privilege management and ensure that API key scopes are strictly enforced.

Description Summary:
A template engine injection vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via the Twig template engine.

Executive Summary:
A high-severity vulnerability in the Twig template engine within Grav CMS versions prior to 2.0.13 enables authenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-72827

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability (CWE-1336) arises from the improper neutralization of special elements used in the Twig template engine. Authenticated attackers can leverage this flaw to manipulate templates and execute unauthorized code within the application context.

Business Impact

A CVSS score of 8.8 underscores the gravity of this issue, as it grants attackers the ability to compromise the integrity and confidentiality of the entire CMS installation. Unauthorized code execution can lead to full system takeover and persistent backdoors within the web application.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later to apply the necessary template engine security fixes.

Proactive Monitoring: Monitor template file changes and review server logs for unusual Twig engine errors or unauthorized code execution attempts.

Compensating Controls: Implement a Web Application Firewall with rules designed to detect and block malicious template injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Template injection is a common method for attackers to achieve code execution.

Analyst Recommendation

All Grav CMS instances must be updated to version 2.0.13 to remediate this vulnerability. Given the ease of potential exploitation via template manipulation, prompt patching is essential to maintain the security posture of the web environment.

Description Summary:
The getgrav grav-plugin-api fails to validate API key scopes during creation, allowing attackers to mint unauthorized, full-access super keys.

Executive Summary:
A critical vulnerability in the Grav API plugin allows unauthenticated attackers to escalate privileges by minting administrative API keys, posing a total risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-72826

Affected Software: getgrav Grav

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) within the createApiKey function. The application fails to perform a subset check on requested scopes, allowing an attacker with minimal privileges to mint a super-user key.

Business Impact

Successful exploitation results in full administrative control over the Grav instance. Given the critical CVSS score of 9.8, this flaw facilitates complete system compromise, including the potential for unauthorized configuration changes and remote code execution.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later immediately.

Proactive Monitoring: Audit existing API keys for unexpected administrative scopes and monitor system logs for suspicious key generation events.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to the API endpoints and employ strict network segmentation to limit exposure of the administrative interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of server-side validation on user-supplied scope arrays.

Analyst Recommendation

This vulnerability represents a severe security risk that enables total account takeover. Organizations must prioritize patching to version 1.0.13 to prevent unauthorized privilege escalation and ensure the integrity of the Grav environment.

Description Summary:
A missing authorization vulnerability in the getgrav grav-plugin-api allows authenticated users to perform unauthorized actions via the ReportsController.

Executive Summary:
An authenticated missing authorization vulnerability in the getgrav grav-plugin-api could allow unauthorized integrity impacts on the affected system.

Vulnerability Details

CVE-ID: CVE-2026-72825

Affected Software: getgrav grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability, classified as CWE-862, occurs because the application fails to perform adequate authorization checks for API requests. An attacker with low-level privileges can exploit this to perform actions they are not authorized to access.

Business Impact

With a CVSS score of 7.6, this vulnerability carries significant risk regarding the integrity of data within the Grav environment. Unauthorized access to administrative or sensitive functions could lead to data manipulation, unauthorized configuration changes, and potential service disruption, affecting the overall security posture of the platform.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.13 or later to ensure that proper authorization checks are enforced.

Proactive Monitoring: Review application logs for suspicious API calls or unexpected administrative actions performed by low-privileged user accounts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block suspicious API requests that attempt to access restricted controller endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is not automatable, requiring a degree of effort from the attacker.

Analyst Recommendation

Given the evidence of a proof-of-concept, prompt remediation is required to secure the Grav installation. Administrators should apply the 1.0.13 update immediately to mitigate the risk of unauthorized privilege escalation and data manipulation.

Description Summary:
The Grav API plugin contains an authorization bypass in PagesController that allows unauthenticated attackers to achieve server-side template injection and remote code execution.

Executive Summary:
A critical authorization bypass in the Grav API plugin allows unauthenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-72824

Affected Software: getgrav Grav

Affected Versions: 0 up to 1.0.13

Vulnerability: This vulnerability involves a missing authorization check within the PagesController::guardTwigContent function. An unauthenticated attacker can manipulate API key scopes to enable Twig processing, leading to server-side template injection and remote code execution.

Business Impact

Successful exploitation grants an attacker full control over the web server hosting the Grav instance. This can lead to complete data compromise, unauthorized modification of site content, and potential lateral movement within the network. Given the CVSS score of 9.8, the risk to confidentiality, integrity, and availability is considered critical.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.13 or later immediately.

Proactive Monitoring: Monitor server logs for unusual API requests or patterns suggesting attempted injection of Twig syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious template injection payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it allows an attacker to bypass security gates and execute server-side code.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the Grav API plugin to version 1.0.13 to eliminate the risk of remote code execution. Failure to patch may expose the system to high-impact attacks.

Description Summary:
A critical authentication bypass vulnerability in the getgrav/grav-plugin-api package allows unauthorized users to disable two-factor authentication on target accounts.

Executive Summary:
An authentication bypass in the grav-plugin-api allows unauthorized users to disable two-factor authentication on target accounts, facilitating full account takeover.

Vulnerability Details

CVE-ID: CVE-2026-72822

Affected Software: getgrav grav (grav-plugin-api)

Affected Versions: 0 up to (excluding) 1.0.13

Vulnerability: The disable2fa endpoint fails to invoke necessary permission checks, allowing users with limited API access to bypass security controls. This permits the disabling of two-factor authentication on non-super accounts without requiring a TOTP code.

Business Impact

By enabling the removal of two-factor authentication, an attacker can effectively bypass the primary protection mechanism for user accounts. This facilitates account takeover, which can lead to unauthorized administrative access and potential data breaches. The CVSS score of 9.8 reflects the ease of exploitation and the high impact on account security.

Remediation Plan

Immediate Action: Update the getgrav grav-plugin-api component to version 1.0.13 or later. This version correctly enforces API key scope caps and mandatory permission checks for the disable2fa endpoint.

Proactive Monitoring: Review logs for unusual calls to the /api/v1/users/{user}/2fa/disable endpoint. Monitor for unexpected modifications to user account security settings, particularly the removal of 2FA.

Compensating Controls: Restrict access to the API endpoints via network-level controls or WAF rules if immediate patching is not feasible. Audit existing API keys to ensure they adhere to the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical because it directly undermines multi-factor authentication, which is a primary defensive control.

Analyst Recommendation

The ability to bypass 2FA is a major security risk that should be addressed immediately. Organizations using the Grav API plugin must update to version 1.0.13 to prevent potential account takeovers and maintain the security posture of their administrative users.

Description Summary:
An improper control of code generation vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via malicious ZIP file uploads.

Executive Summary:
A critical remote code execution vulnerability in Grav CMS versions prior to 2.0.13 permits authenticated users to gain unauthorized command execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-72819

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability, categorized as CWE-94, involves improper control of code generation during the processing of ZIP file uploads. An authenticated user with sufficient privileges can upload a crafted archive to achieve remote code execution on the underlying server.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to the entire server environment. An attacker achieving remote code execution can steal sensitive data, modify application files, or pivot deeper into the corporate network, leading to significant reputational and financial damage.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later immediately.

Proactive Monitoring: Inspect server logs for suspicious file upload activity or unexpected execution of system commands by the web server user.

Compensating Controls: Ensure that the web application directory has restricted permissions and that the web server is configured to prevent the execution of scripts in upload directories.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Remote code execution flaws are high-value targets for attackers.

Analyst Recommendation

The risk of remote code execution requires immediate attention. Organizations utilizing Grav CMS must upgrade to the patched version 2.0.13 without delay to eliminate the underlying code injection vector.

Description Summary:
A timing attack vulnerability in the Grav login plugin before 3.9.1 allows unauthenticated attackers to potentially infer valid security tokens due to non-constant time comparisons.

Executive Summary:
A timing discrepancy in the Grav login plugin could allow an unauthenticated attacker to infer sensitive security tokens, posing a risk to account authentication mechanisms.

Vulnerability Details

CVE-ID: CVE-2026-72700

Affected Software: Grav (grav-plugin-login)

Affected Versions: 0 up to 3.9.1

Vulnerability: This vulnerability (CWE-208) exists because the plugin uses a non-constant-time string comparison for password reset and account activation tokens. An unauthenticated attacker can exploit timing differences during the token-submission process to brute-force or guess valid security tokens.

Business Impact

An attacker could potentially bypass account activation or password reset protections, leading to unauthorized account access. While the vendor notes that an end-to-end network exploit is currently unproven, the CVSS score of 7.5 highlights the potential risk to account integrity and authentication security.

Remediation Plan

Immediate Action: Update the Grav login plugin to version 3.9.1 or later, which implements the secure hash_equals() function for token comparisons.

Proactive Monitoring: Implement rate limiting on the token-submission endpoint to mitigate the feasibility of automated timing attacks.

Compensating Controls: Monitor application access logs for high volumes of failed token-submission attempts, which may indicate an ongoing enumeration or brute-force effort.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of rate limiting on the affected endpoint exacerbates the risk of this timing-based flaw.

Analyst Recommendation

The vulnerability requires immediate attention. Administrators must update the Grav login plugin to version 3.9.1 to ensure that security tokens are compared using constant-time operations, thereby neutralizing the timing attack vector.

Description Summary:
Grav CMS contains a symlink following vulnerability in the Scheduler job lock file creation process, allowing local attackers to overwrite arbitrary files on the system.

Executive Summary:
Grav CMS is vulnerable to a local file overwrite attack caused by improper symlink resolution during the creation of lock files.

Vulnerability Details

CVE-ID: CVE-2026-72696

Affected Software: Grav Grav CMS

Affected Versions: 0 up to 2.0.16

Vulnerability: This flaw exists in the Scheduler Job::createLockFile() function, where predictable lock file paths in world-writable directories can be leveraged by local attackers to perform symlink attacks.

Business Impact

A local attacker with sufficient access to the server environment can use this vulnerability to overwrite arbitrary files, including system configuration or application files. This can lead to privilege escalation, service disruption, or the compromise of sensitive data. With a CVSS score of 8.4, this vulnerability represents a significant risk to the host environment.

Remediation Plan

Immediate Action: Upgrade Grav CMS to version 2.0.16 or later to secure the lock file creation process.

Proactive Monitoring: Monitor the system for the creation of unexpected symlinks in temporary directories or unusual file modification events within the application root.

Compensating Controls: Restrict permissions on temporary directories to prevent unauthorized users from creating symlinks in paths used by the web application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires local access to the server, which limits the attack surface but remains a high risk for multi-user environments.

Analyst Recommendation

Local file overwrite vulnerabilities often serve as a precursor to full system escalation. Administrators should apply the provided update immediately to ensure that file operations are performed securely and are no longer susceptible to symlink manipulation.

Description Summary:
Grav contains a path traversal vulnerability in the MediaUploadTrait::deleteFile method, allowing authenticated users with media management permissions to delete arbitrary files on the server.

Executive Summary:
A path traversal flaw in the Grav media management system allows authenticated users to delete arbitrary files, posing a severe risk to system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-72695

Affected Software: Grav

Affected Versions: 0 up to (excluding) 2.0.16

Vulnerability: The vulnerability exists in the MediaUploadTrait::deleteFile() method, which fails to properly sanitize directory traversal sequences in filenames. An authenticated user with sufficient permissions can leverage this to escape the intended media directory and delete files anywhere the web server process has write access.

Business Impact

The ability to delete arbitrary files on a web server can lead to catastrophic system failure, loss of critical data, and potential site defacement. With a CVSS score of 8.1, this vulnerability is considered High, as it directly impacts the availability and integrity of the hosting environment.

Remediation Plan

Immediate Action: Update Grav to version 2.0.16 or later to apply the necessary fixes to the MediaUploadTrait.

Proactive Monitoring: Review application and system logs for unauthorized file deletion events or suspicious requests targeting the media management interface.

Compensating Controls: Implement strict file system permissions to ensure the web server user only has write access to the specific directories required for its operation, limiting the impact of a potential traversal attack.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is technically trivial to trigger once access to the media management interface is obtained.

Analyst Recommendation

Given the availability of a proof-of-concept and the potential for significant system damage, administrators must upgrade to version 2.0.16 immediately. Ensure that all users with media management capabilities are trusted and that their activities are audited until the update is applied.

Description Summary:
Grav CMS is vulnerable to path traversal, which may allow an unauthenticated attacker to access restricted files on the server.

Executive Summary:
Grav CMS is susceptible to a path traversal vulnerability that could allow an unauthenticated attacker to read sensitive files on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-69089

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.11

Vulnerability: This is a path traversal vulnerability (CWE-22) that occurs when user-supplied input is not properly sanitized before being used in file system operations, specifically within the watermark functionality. An unauthenticated attacker can manipulate the path to traverse directories and access files outside of the intended directory.

Business Impact

Successful exploitation allows an attacker to retrieve sensitive configuration files, source code, or other restricted data stored on the web server. This unauthorized access can lead to complete system compromise or information disclosure, justifying the high severity CVSS score of 7.5.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.11 or later to implement the necessary path sanitization fixes.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the watermark or image processing modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing malicious path traversal sequences before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via simple crafted HTTP requests.

Analyst Recommendation

Due to the existence of a proof-of-concept and the high risk of information disclosure, administrators must prioritize updating to Grav CMS version 2.0.11. Ensuring the application is patched is essential to protecting sensitive server-side data from unauthorized access.

Description Summary:
Grav CMS is vulnerable to arbitrary method invocation, which may lead to code injection via manipulated blueprints.

Executive Summary:
A high-severity code injection vulnerability in Grav CMS allows authenticated attackers to execute arbitrary methods, necessitating an immediate system update.

Vulnerability Details

CVE-ID: CVE-2026-69088

Affected Software: getgrav grav

Affected Versions: 2.0.7 up to (excluding) 2.0.11

Vulnerability: This vulnerability is categorized as CWE-94 (Improper Control of Generation of Code). It allows an authenticated user to perform arbitrary method invocation through the blueprint system, which can be leveraged to achieve code injection within the CMS environment.

Business Impact

The CVSS score of 8.1 indicates a high risk to the platform. An attacker with administrative or low-level access could escalate privileges or gain remote code execution, leading to full site compromise, defacement, or the theft of sensitive configuration data and user credentials stored within the CMS.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.11 or later to remediate the vulnerability.

Proactive Monitoring: Monitor server logs and file integrity systems for unauthorized changes or the execution of unexpected system commands originating from the CMS administrative interface.

Compensating Controls: Use a Web Application Firewall (WAF) to filter suspicious requests that attempt to invoke restricted methods or modify blueprints via the administrative dashboard.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for any actor with authenticated access to the CMS.

Analyst Recommendation

The presence of a proof-of-concept and the critical nature of the flaw make this an urgent security priority. Administrators should apply the 2.0.11 patch immediately to prevent the potential for unauthorized code execution and complete system takeover.

Description Summary:
The Grav API Plugin contains an improper privilege management vulnerability that allows authenticated users to escalate privileges via invitations and groups.

Executive Summary:
An improper privilege management vulnerability in the Grav API Plugin allows authenticated users to perform unauthorized privilege escalation, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-65897

Affected Software: Grav API Plugin

Affected Versions: 0 up to 1.0.10

Vulnerability: This is a privilege management flaw (CWE-269) within the Grav API Plugin. The vulnerability requires the attacker to be authenticated as a lower-privileged user to exploit the API endpoints related to invitations and group management.

Business Impact

If exploited, this vulnerability allows a standard user to gain administrative or elevated access to the Grav platform. This compromise can lead to full system control, unauthorized data exfiltration, or complete platform takeover. The CVSS score of 8.8 reflects the high potential for total technical impact on the host application.

Remediation Plan

Immediate Action: Update the Grav API Plugin to version 1.0.10 or later immediately.

Proactive Monitoring: Review user account management logs for suspicious activities or unauthorized changes to user roles and group permissions.

Compensating Controls: Restrict access to the API plugin to trusted IP addresses or require additional multi-factor authentication for administrative actions if patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable once an attacker has gained standard user access.

Analyst Recommendation

Privilege escalation vulnerabilities are critical and must be prioritized. Organizations should audit their current Grav API Plugin deployments and apply the provided patch to prevent unauthorized escalation and maintain the security posture of their CMS environment.

Description Summary:
The Grav API Plugin is susceptible to a missing authorization vulnerability that allows attackers to manipulate API functions due to broken access control.

Executive Summary:
A missing authorization vulnerability in the Grav API Plugin allows for unauthorized access to sensitive API functions, leading to potential integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-65895

Affected Software: Grav API Plugin

Affected Versions: 0 up to 1.0.10

Vulnerability: This is a missing authorization flaw (CWE-862) occurring within the Grav API Plugin. The vulnerability allows for broken access control where specific API functions are not properly protected, allowing unauthorized actors to perform actions they should not be permitted to execute.

Business Impact

Successful exploitation allows unauthorized users to perform sensitive operations via the API, which could lead to the modification of system configurations or content. With a CVSS score of 8.5, this vulnerability presents a high risk of integrity compromise, potentially leading to reputational damage or system instability.

Remediation Plan

Immediate Action: Update the Grav API Plugin to version 1.0.10 or later immediately.

Proactive Monitoring: Audit API request logs for unauthorized access attempts or unexpected modifications to site data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or unauthorized API requests to the Grav backend.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it bypasses standard authorization checks required for secure API usage.

Analyst Recommendation

Missing authorization in API components is a critical security gap. Administrators must ensure the Grav API Plugin is updated to the latest version to close this access control hole and prevent unauthorized manipulation of the application.

Description Summary:
Grav versions 1.7.0 through 2.0.8 are vulnerable to unsafe reflection (CWE-470), allowing an authenticated attacker to perform remote code execution via FlexDirectory.

Executive Summary:
A critical remote code execution vulnerability in the Grav CMS allows authenticated attackers to manipulate system classes, necessitating an immediate update to version 2.0.9.

Vulnerability Details

CVE-ID: CVE-2026-65608

Affected Software: getgrav Grav

Affected Versions: getgrav grav: 1.7.0 up to (excluding) 2.0.9

Vulnerability: The vulnerability is categorized as CWE-470, involving unsafe reflection where externally controlled input is used to select classes or code. The attacker must possess authenticated access to the application to trigger this flaw.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the Grav CMS instance. Exploitation could allow an attacker to gain full administrative control over the web server, leading to site defacement, data exfiltration, or the deployment of malicious payloads.

Remediation Plan

Immediate Action: Upgrade the Grav CMS installation to version 2.0.9 or higher to apply the necessary security fixes.

Proactive Monitoring: Monitor server logs for unusual HTTP requests targeting the FlexDirectory component or suspicious file modifications.

Compensating Controls: If immediate patching is not feasible, implement strict input validation at the Web Application Firewall (WAF) level to block requests attempting to exploit reflection-based vulnerabilities.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of unsafe reflection vulnerabilities makes them highly susceptible to weaponization.

Analyst Recommendation

Given the availability of a proof-of-concept and the high severity of the vulnerability, organizations should treat this as a high-priority task. Updating to version 2.0.9 is the only definitive way to eliminate the underlying security flaw.

Description Summary:
An improper privilege management vulnerability in the Grav Login plugin allows authenticated attackers to escalate their privileges.

Executive Summary:
An authenticated privilege escalation vulnerability in the Grav Login plugin allows users to gain unauthorized access to administrative functions.

Vulnerability Details

CVE-ID: CVE-2026-65603

Affected Software: getgrav grav (Login plugin)

Affected Versions: 0 up to (excluding) 3.8.12

Vulnerability: This is a privilege management vulnerability (CWE-269) that occurs when updating user profiles. It allows an authenticated user to modify their own privilege level beyond what is permitted, effectively escalating their access rights.

Business Impact

The CVSS score of 8.8 reflects the high risk of a full administrative compromise of the Grav installation. Unauthorized access to administrative functions can lead to total system takeover, unauthorized content modification, and potential data exfiltration. Given that this is a privilege escalation, it poses a severe threat to the integrity of the entire web application.

Remediation Plan

Immediate Action: Update the Grav Login plugin to version 3.8.12 or higher immediately.

Proactive Monitoring: Audit user account changes and administrative logs for any unexpected elevation of user roles or unauthorized profile updates.

Compensating Controls: Implement an administrative firewall policy that restricts access to the backend management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable for any user with valid login credentials.

Analyst Recommendation

Immediate patching is required to prevent potential privilege escalation attacks. In addition to updating, perform a thorough review of all user accounts to ensure no unauthorized administrative accounts have been created or modified during the period the system was vulnerable.

Description Summary:
The Grav API Plugin contains a missing authorization vulnerability that allows authenticated users to access sensitive content.

Executive Summary:
A missing authorization vulnerability in the Grav API Plugin allows authenticated users to access and manipulate restricted site content.

Vulnerability Details

CVE-ID: CVE-2026-64852

Affected Software: getgrav grav-plugin-api

Affected Versions: < 1.0.8

Vulnerability: This vulnerability is a missing authorization flaw (CWE-862) within the API plugin, which allows an attacker with low-level privileges to perform unauthorized actions on the site content.

Business Impact

Unauthorized access to site content can lead to data breaches, loss of intellectual property, and unauthorized modification of website data. The CVSS score of 8.7 highlights the severe impact this can have on site integrity and confidentiality for Grav CMS users.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.8 or later immediately.

Proactive Monitoring: Review API access logs for suspicious account activity or requests that deviate from typical user behavior.

Compensating Controls: If an update is delayed, disable the Grav API plugin or implement strict IP-based access controls for the RESTful API endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

The authorization bypass vulnerability poses a significant risk to the integrity of Grav CMS environments. System administrators should upgrade to version 1.0.8 immediately to ensure that access controls are correctly enforced and to prevent unauthorized data access.

Description Summary:
Grav versions prior to 2.0.7 are susceptible to a code injection vulnerability that allows authenticated users to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in Grav versions before 2.0.7 enables authenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-64850

Affected Software: getgrav grav

Affected Versions: < 2.0.7

Vulnerability: The platform is susceptible to improper control of code generation (CWE-94), which, when triggered by an authenticated user, allows for the injection and execution of arbitrary code.

Business Impact

An attacker capable of executing arbitrary code can gain full control over the web server, leading to total compromise of the application and its data. With a CVSS score of 8.7, this represents a critical risk to the business, including the potential for data exfiltration and complete system takeover.

Remediation Plan

Immediate Action: Update Grav to version 2.0.7 or later immediately to patch the code injection vulnerability.

Proactive Monitoring: Monitor server logs for suspicious system-level commands or file modifications that deviate from standard Grav operations.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common code injection patterns and malicious payloads targeting the Grav environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of code injection makes this a high-priority target for attackers seeking persistence.

Analyst Recommendation

Given the potential for complete system compromise via code injection, it is imperative to apply the 2.0.7 update without delay. Users should also audit their current configurations to ensure no malicious persistence mechanisms were established prior to the update.

Description Summary:
The Grav API Plugin for Grav CMS is susceptible to an authorization bypass, allowing authenticated users to access or modify content beyond their intended permissions.

Executive Summary:
A vulnerability in the Grav API Plugin allows authenticated attackers to bypass authorization controls, potentially leading to unauthorized data access and modification.

Vulnerability Details

CVE-ID: CVE-2026-62666

Affected Software: getgrav grav-plugin-api

Affected Versions: < 1.0.6

Vulnerability: This is an authorization bypass vulnerability (CWE-639, CWE-862) within the RESTful API component. The plugin fails to properly validate the authorization level of authenticated users, permitting unauthorized access to site content.

Business Impact

The ability to bypass authorization controls means that an authenticated user could potentially view, modify, or delete sensitive site content, leading to data breaches or site defacement. With a CVSS score of 8.8, this poses a substantial risk to the integrity and confidentiality of the CMS content.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.6 or higher to resolve the authorization logic flaws.

Proactive Monitoring: Monitor API access logs for anomalous requests or attempts to access content that typically requires higher administrative privileges.

Compensating Controls: Implement WAF rules to validate API requests and restrict access to sensitive endpoints based on user roles until the update is applied.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is a direct consequence of missing capability checks, which is a common but critical oversight in plugin development.

Analyst Recommendation

Administrators should treat this update as mandatory to maintain the security posture of their CMS. The lack of authorization checks makes the API a high-value target for authenticated users looking to escalate their access.

Description Summary:
Grav contains a Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests by exploiting unrestricted curl protocols.

Executive Summary:
A Server-Side Request Forgery vulnerability in Grav allows authenticated attackers to potentially compromise backend resources and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-62234

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) stemming from the use of unrestricted curl protocols. The vulnerability requires the attacker to be authenticated to the application to trigger the malicious request.

Business Impact

An SSRF vulnerability can be leveraged to bypass network segmentation, allowing an attacker to probe internal services, access sensitive cloud metadata, or interact with databases that are not exposed to the public internet. With a CVSS score of 8.1, this represents a significant risk of internal reconnaissance and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Grav to version 2.0.4 or later to implement necessary restrictions on curl protocols.

Proactive Monitoring: Review web server and application logs for outgoing requests to unexpected or internal IP addresses initiated by the application service.

Compensating Controls: Implement strict egress filtering on the host running the Grav application to prevent the server from initiating unauthorized connections to internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the web server has broad network reach.

Analyst Recommendation

The risk posed by SSRF vulnerabilities is high because they often serve as a gateway to deeper network penetration. Organizations should verify their current version of Grav and apply the patch immediately to prevent attackers from utilizing the application as a proxy for internal network exploitation.

Description Summary:
The Grav CMS API is vulnerable to privilege escalation due to missing authorization checks in its API key creation mechanism.

Executive Summary:
A critical privilege escalation vulnerability in the Grav CMS API allows authenticated users to gain unauthorized administrative access, posing a severe risk to site security.

Vulnerability Details

CVE-ID: CVE-2026-62233

Affected Software: getgrav grav

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This is an authorization bypass (CWE-639) and missing authorization (CWE-862) flaw. The vulnerability allows a low-privileged authenticated user to manipulate API key creation, resulting in full unauthorized access.

Business Impact

An attacker who successfully exploits this vulnerability can gain administrative privileges, leading to full control over the Grav CMS instance. With a CVSS score of 8.8, the potential for data theft, site defacement, or total system compromise is extreme.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.6 or later immediately.

Proactive Monitoring: Review API key creation logs and audit user privilege changes to identify any anomalous administrative account activity.

Compensating Controls: Restrict access to the API endpoints to known, trusted IP addresses using a WAF or server-level firewall until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it allows direct escalation of privileges from an authenticated user.

Analyst Recommendation

This vulnerability represents a critical threat to the security of any Grav CMS installation. Administrators are urged to apply the provided fix immediately to prevent the escalation of privileges and potential site takeover.

Description Summary:
The Grav API plugin is affected by an incorrect authorization vulnerability that allows authenticated users to bypass API key scope restrictions.

Executive Summary:
An authorization bypass vulnerability in the Grav API plugin allows authenticated users to exceed their assigned access scopes, potentially leading to unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-62231

Affected Software: getgrav grav (Grav API plugin)

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This vulnerability (CWE-863) exists in the API key authentication mechanism of the Grav API plugin. It requires a user to be authenticated, but allows them to bypass the intended scope restrictions associated with their API key.

Business Impact

By bypassing scope restrictions, an authenticated user could access or modify data they are not authorized to interact with. With a CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and integrity, particularly in environments where multiple users share API access.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.6 or later to enforce correct authorization scoping.

Proactive Monitoring: Review API access logs to identify users or service accounts accessing endpoints or data outside of their typical operational scope.

Compensating Controls: Audit all active API keys and restrict the privileges associated with them to the minimum necessary level until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is constrained to authenticated users, which necessitates robust internal identity and access management practices.

Analyst Recommendation

Although this vulnerability requires authentication, the potential for privilege escalation within the API is significant. All Grav users should update the API plugin to version 1.0.6 immediately to ensure that scope-based access controls are correctly enforced.

Description Summary:
The Grav API plugin is vulnerable to an unrestricted file upload flaw, which may allow authenticated users with low privileges to execute arbitrary code on the server.

Executive Summary:
An unrestricted file upload vulnerability in the Grav API plugin, identified as CVE-2026-61457, poses a significant risk of remote code execution for affected Grav installations.

Vulnerability Details

CVE-ID: CVE-2026-61457

Affected Software: getgrav Grav

Affected Versions: 0 up to (excluding) 1.0.3

Vulnerability: This vulnerability, classified as CWE-434, stems from improper validation of file uploads within the API plugin. An attacker with low privileges can leverage this flaw to upload malicious files, potentially resulting in unauthorized code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass security controls and execute arbitrary code on the underlying web server. This could lead to full system compromise, unauthorized access to sensitive application data, and significant operational disruption. Given the CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent potential exploitation.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.3 or later to apply the necessary security patches.

Proactive Monitoring: Review web server and application logs for unusual file upload activity or requests targeting the API endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious file types and inspect incoming traffic to the API for malicious patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the potential for remote code execution.

Analyst Recommendation

The high CVSS score and the existence of a proof-of-concept make this a priority for security teams. Administrators should verify their current plugin version immediately and apply the 1.0.3 update. Failure to patch may expose the environment to critical security risks.

Description Summary:
The Grav API plugin is vulnerable to an open redirect during password reset, allowing attackers to hijack reset tokens and perform full account takeover.

Executive Summary:
A critical vulnerability in the Grav API plugin permits unauthenticated attackers to hijack user password reset flows, leading to full account takeover.

Vulnerability Details

CVE-ID: CVE-2026-61451

Affected Software: getgrav grav

Affected Versions: 0 up to 1.0.4

Vulnerability: The API endpoint fails to validate the host origin for password reset links, enabling an unauthenticated attacker to redirect the reset token to an attacker-controlled server, thereby capturing the token and gaining unauthorized access.

Business Impact

The ability for an attacker to perform full account takeover, including administrative accounts, creates a severe risk to the confidentiality and integrity of the entire Grav installation. Given the 9.6 CVSS score, this vulnerability could result in total compromise of site data and user information.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.4 or later to implement correct origin validation.

Proactive Monitoring: Audit password reset logs for unusual request patterns or redirects to unexpected hostnames.

Compensating Controls: Implement strict Content Security Policy (CSP) headers and monitor for unauthorized outbound traffic from the application server.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherent in the logic of the password reset API implementation.

Analyst Recommendation

This vulnerability is critical due to the potential for complete account takeover. Security teams must ensure the API plugin is updated to 1.0.4 immediately to prevent token harvesting and unauthorized access.

Description Summary:
The Grav Admin plugin is vulnerable to an authorization bypass, allowing authenticated users to perform unauthorized administrative actions through user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in the Grav Admin plugin allows authenticated users to escalate privileges and perform unauthorized administrative tasks.

Vulnerability Details

CVE-ID: CVE-2026-59190

Affected Software: GetGrav Grav Admin Plugin

Affected Versions: <= 1.10.52

Vulnerability: This vulnerability (CWE-639) occurs in the administrative interface, where improper validation of user-controlled keys allows an attacker with low-level privileges to bypass authorization checks. This effectively grants the user administrative control over the platform's configuration and page management.

Business Impact

Successful exploitation grants an attacker full control over the Grav CMS interface, enabling them to modify content, alter site configurations, or potentially inject malicious scripts. Given the CVSS score of 8.7, this is a critical threat to the integrity and availability of the web platform, as it permits unauthorized administrative actions.

Remediation Plan

Immediate Action: Update the Grav Admin plugin to the latest version provided by the vendor to ensure proper authorization checks are enforced.

Proactive Monitoring: Review administrative audit logs for unauthorized configuration changes or page modifications that occur outside of expected maintenance windows.

Compensating Controls: Implement strict role-based access control (RBAC) and limit administrative access to the Grav dashboard to trusted IP addresses via a Web Application Firewall (WAF).

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass authorization in an administrative plugin is a severe security failure. Administrators must ensure the plugin is updated immediately to prevent privilege escalation attacks that could lead to full site takeover.

Description Summary:
The Grav Flex Objects plugin is vulnerable to server-side template injection, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A server-side template injection flaw in the Grav Flex Objects plugin allows authenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-58655

Affected Software: Grav Grav

Affected Versions: 0 up to 1.4.0

Vulnerability: The Grav Flex Objects plugin is susceptible to code injection (CWE-94) via dynamic titles, which permits an authenticated attacker to perform server-side template injection. This allows for the execution of arbitrary code within the application context.

Business Impact

Rated at 8.8 on the CVSS scale, this vulnerability represents a severe threat to the integrity and availability of the Grav CMS. Successful exploitation enables an attacker to gain full control over the web server, leading to potential data theft, site defacement, or the deployment of persistent malware.

Remediation Plan

Immediate Action: Update the Grav Flex Objects plugin to version 1.4.0 or later to patch the template injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual system calls or command execution attempts originating from the web application process.

Compensating Controls: Restrict administrative access to trusted personnel only and employ a Web Application Firewall to inspect and sanitize input fields for common template injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires authenticated access, which serves as a primary barrier to entry.

Analyst Recommendation

While this vulnerability requires authentication, the potential for remote code execution makes it a high-priority item. Administrators must update the affected plugin to version 1.4.0 immediately to prevent potential system-level compromise.

Description Summary:
The grav-plugin-database for Grav CMS is vulnerable to SQL injection via the PDO::tableExists method due to improper input sanitization.

Executive Summary:
A critical SQL injection vulnerability in the Grav CMS database plugin allows unauthorized attackers to execute arbitrary SQL commands against the backend database.

Vulnerability Details

CVE-ID: CVE-2026-58492

Affected Software: getgrav grav

Affected Versions: < 1.2.0

Vulnerability: The plugin fails to sanitize the table argument in the PDO::tableExists method before interpolating it into a raw SQL query. This allows an attacker to inject arbitrary SQL commands, resulting in unauthorized database interaction.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to the complete exposure of sensitive site data, unauthorized modification of records, or potential administrative account takeover. With a CVSS score of 9.2, the vulnerability poses a high risk to the confidentiality and integrity of the CMS-managed data.

Remediation Plan

Immediate Action: Update the grav-plugin-database to version 1.2.0 or later to resolve the SQL injection flaw.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected table enumeration or syntax errors indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection capabilities to block malicious payloads targeting the database plugin.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of SQL injection vulnerabilities, immediate application of the provided patch is essential. Organizations should update the plugin and perform a security audit of the database to ensure no unauthorized modifications have occurred prior to the update.

Description Summary:
The Grav Login plugin before 1.0.16 fails to validate privilege levels in the API, allowing attackers to remove brute-force protection from high-privilege accounts.

Executive Summary:
A privilege-related vulnerability in the Grav Login plugin allows unauthorized users to disable brute-force protections for administrative accounts.

Vulnerability Details

CVE-ID: CVE-2026-56710

Affected Software: getgrav grav

Affected Versions: 0 up to (excluding) 1.0.16

Vulnerability: The Grav Login plugin fails to perform necessary capability checks within the onApiUserListRowAction function. This allows an attacker with existing lower-level API permissions to clear lockout counters for admin.super accounts, effectively bypassing brute-force security controls.

Business Impact

By disabling brute-force protections on administrative accounts, an attacker significantly increases the success probability of credential-stuffing or brute-force attacks. This vulnerability effectively lowers the barrier for full administrative takeover of the Grav CMS environment.

Remediation Plan

Immediate Action: Update the Grav Login plugin to version 1.0.16 or higher immediately to resolve the authorization flaw.

Proactive Monitoring: Audit user activity logs for unusual API calls or repeated attempts to clear lockout statuses for administrative accounts.

Compensating Controls: Implement multi-factor authentication (MFA) on all administrative accounts to mitigate the risk of password-based attacks, even if brute-force protection is bypassed.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of Aug 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already hold api.users.write permissions, which limits the initial attack surface.

Analyst Recommendation

While an attacker requires some level of API access to leverage this flaw, it represents a significant risk to account security. System administrators should verify their current plugin version and apply the 1.0.16 update to ensure that robust brute-force protections remain active for all users.

Description Summary:
A host header injection vulnerability in Grav before 3.9.2 allows unauthenticated attackers to manipulate invitation links to redirect users to malicious domains.

Executive Summary:
An unauthenticated host header injection flaw in Grav allows attackers to poison email invitation links, potentially leading to unauthorized redirection and user compromise.

Vulnerability Details

CVE-ID: CVE-2026-56709

Affected Software: Grav

Affected Versions: 0 up to 3.9.2

Vulnerability: This vulnerability (CWE-350) stems from the failure to validate untrusted Host headers within the sendInvitationEmail() function. An unauthenticated attacker can manipulate the Host header to craft malicious invitation links that redirect unsuspecting users to attacker-controlled domains.

Business Impact

By poisoning invitation links, an attacker can facilitate phishing campaigns or deliver malicious payloads to legitimate users. This undermines the trust in communications sent from the Grav platform, potentially leading to credential theft or malware infection. The CVSS score of 7.5 reflects the high impact on the confidentiality of user interactions.

Remediation Plan

Immediate Action: Update the Grav installation to version 3.9.2 or later to ensure proper validation of the Host header.

Proactive Monitoring: Monitor application logs for anomalous Host header values or suspicious outbound traffic patterns associated with email invitation features.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and validate the Host header of incoming HTTP requests to block malformed requests before they reach the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on reverse DNS resolution for security-critical actions is a known anti-pattern that this patch effectively remediates.

Analyst Recommendation

Users should immediately update their Grav instances to version 3.9.2. Failure to do so leaves the platform susceptible to link poisoning, which could be leveraged to compromise users of the CMS.

Description Summary:
The Grav Flex Objects plugin is vulnerable to a missing authorization flaw that allows authenticated users to access unauthorized data.

Executive Summary:
A missing authorization vulnerability in the Grav Flex Objects plugin allows authenticated attackers to perform unauthorized data access, posing a significant risk to information confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-56707

Affected Software: Grav Flex Objects plugin

Affected Versions: 0 up to 1.4.8

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862). An authenticated attacker with low privileges can exploit this flaw to access sensitive objects within the system.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to gain unauthorized access to sensitive data handled by the Flex Objects plugin. With a CVSS score of 7.7, this is a high-severity issue, as it permits lateral movement or data exfiltration from an otherwise restricted environment. Organizations relying on Grav for content or data management should prioritize this update to prevent potential data breaches.

Remediation Plan

Immediate Action: Update the Grav Flex Objects plugin to version 1.4.8 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of object access or unauthorized attempts to reach sensitive administrative endpoints.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter requests targeting the Flex Objects module if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization logic error that requires a valid user session.

Analyst Recommendation

This vulnerability represents a significant lapse in access control. Administrators must ensure that the Grav Flex Objects plugin is patched to version 1.4.8 immediately to eliminate this authorization bypass vector and secure sensitive site data.

Description Summary:
Grav is susceptible to a resource exhaustion vulnerability due to improper allocation limits, which can be exploited by unauthenticated attackers to cause a denial-of-service.

Executive Summary:
A resource allocation vulnerability in the Grav platform allows unauthenticated attackers to trigger denial-of-service conditions through resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-53653

Affected Software: GetGrav Grav

Affected Versions: >= 2.0.0-beta.1, < 2.0.0-rc.8; and versions < 1.7.53

Vulnerability: This vulnerability (CWE-770) stems from the platform's failure to properly limit or throttle resource allocation. An unauthenticated attacker can send crafted requests that consume excessive system resources, leading to service unavailability.

Business Impact

The primary impact of this vulnerability is system downtime, as an attacker can easily overwhelm the web platform by exhausting its resources. With a CVSS score of 8.7, this represents a significant risk to service availability, potentially impacting business operations and user access to the hosted content.

Remediation Plan

Immediate Action: Upgrade to Grav version 1.7.53 or 2.0.0-rc.8 or newer to apply necessary resource throttling and allocation limits.

Proactive Monitoring: Monitor server resource utilization (CPU and Memory) and look for spikes in request rates that may indicate an ongoing denial-of-service attempt.

Compensating Controls: Deploy rate-limiting policies on the web server or load balancer to mitigate the impact of excessive requests from suspicious sources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Denial-of-service vulnerabilities in web platforms are highly disruptive. It is essential to apply the provided vendor updates to ensure that resource allocation is managed correctly, thereby preventing attackers from crashing the service.

Description Summary:
Grav is vulnerable to the exposure of sensitive information to an unauthorized actor, allowing authenticated users to access data they should not be permitted to view.

Executive Summary:
A vulnerability in the Grav web platform permits unauthorized access to sensitive information, potentially leading to data leakage.

Vulnerability Details

CVE-ID: CVE-2026-44738

Affected Software: Grav Grav

Affected Versions: < 2.0.0-rc.2

Vulnerability: This vulnerability (CWE-200) involves the exposure of sensitive information to an unauthorized actor. The attack vector is network-based and requires the attacker to have low-level privileges to successfully gain unauthorized access to sensitive data.

Business Impact

With a CVSS score of 7.7, this vulnerability represents a significant risk to data confidentiality. Unauthorized access to sensitive information can result in the compromise of proprietary configuration data, user information, or administrative credentials, potentially leading to further escalation of privileges or broader system compromise.

Remediation Plan

Immediate Action: Update Grav to version 2.0.0-rc.2 or later to resolve the information exposure flaw.

Proactive Monitoring: Review application access logs for unusual patterns of data retrieval or unauthorized access requests to sensitive directories.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter suspicious requests and limit exposure to sensitive endpoints until the platform can be patched.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of May 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

The existence of a proof-of-concept elevates the urgency of this vulnerability. Administrators should treat this as a high-priority update to ensure that sensitive information is properly protected and that unauthorized actors cannot exploit the current information disclosure flaw.

Description Summary:
An incorrect authorization vulnerability in the Grav API Plugin allows unauthorized users to perform actions exceeding their intended permissions.

Executive Summary:
The Grav API Plugin is susceptible to an authorization bypass vulnerability, potentially allowing unauthorized access to sensitive site configuration and user data.

Vulnerability Details

CVE-ID: CVE-2026-42843

Affected Software: Grav Grav API Plugin

Affected Versions: < 1.0.0-beta.15

Vulnerability: This is an authorization flaw (CWE-863) within the RESTful API component. It allows an attacker to interact with site content, media, and system management functions without proper validation of user privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a high risk of total system compromise. Unauthorized access to the Grav CMS through the API could result in data exfiltration, unauthorized modification of site configuration, and potential takeover of administrative accounts.

Remediation Plan

Immediate Action: Upgrade the Grav API Plugin to version 1.0.0-beta.15 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Audit API access logs for unauthorized attempts to access administrative endpoints or system configuration files.

Compensating Controls: Restrict access to the API endpoints via IP whitelisting or disable the API plugin entirely if it is not required for current site operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of a Proof-of-Concept (PoC) increases the risk of near-term exploitation.

Analyst Recommendation

Administrators must verify their current plugin version and apply the update immediately. Given that this vulnerability allows for total system impact, failure to patch could lead to a complete compromise of the CMS.

Description Summary:
Grav CMS is vulnerable to an authentication bypass during user registration, allowing an unauthenticated user to assign themselves administrative privileges.

Executive Summary:
An unauthenticated attacker can gain full administrative control of a Grav CMS instance by exploiting a flaw in the user registration process.

Vulnerability Details

CVE-ID: CVE-2026-42613

Affected Software: Grav CMS

Affected Versions: Prior to 2.0.0-beta.2

Vulnerability: This is an authentication and privilege escalation vulnerability in the Login::register() method. The method fails to validate input for group and access fields, allowing any unauthenticated user to register with admin.super privileges.

Business Impact

This vulnerability allows an attacker to take over the entire content management system, leading to total loss of control over the website's content, users, and configuration. The 9.4 CVSS score reflects the high risk of complete platform takeover.

Remediation Plan

Immediate Action: Upgrade to Grav version 2.0.0-beta.2 or later.

Proactive Monitoring: Review the user list for unauthorized accounts with administrative roles and audit registration logs for anomalous activity.

Compensating Controls: If upgrading is not immediately possible, disable user registration functionality.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is essential. Organizations should update their Grav installation and conduct a thorough audit of their user base to ensure no unauthorized administrative accounts have been created.

Description Summary:
Grav contains a Cross-site Scripting (XSS) vulnerability allowing authenticated users with low privileges to inject malicious scripts, leading to potential unauthorized information disclosure.

Executive Summary:
A Cross-site Scripting vulnerability in Grav allows authenticated attackers to potentially compromise user sessions and sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-42612

Affected Software: getgrav Grav

Affected Versions: < 2.0.0-beta.2

Vulnerability: This is a Stored Cross-site Scripting (CWE-79) vulnerability. It requires the attacker to have low-level authenticated access to the platform to inject malicious scripts into web pages.

Business Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's session, potentially leading to unauthorized access to sensitive data or session hijacking. Given the CVSS score of 8.5, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of the platform's administrative and user interactions.

Remediation Plan

Immediate Action: Update the Grav platform to version 2.0.0-beta.2 or later to apply the necessary security patches.

Proactive Monitoring: Review web server access logs for unusual patterns or payloads in request parameters that may indicate injection attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any authenticated user capable of interacting with the vulnerable input fields.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Administrators should prioritize updating to the patched version, 2.0.0-beta.2, to eliminate the risk of XSS-based attacks. Failure to patch may allow attackers to leverage authenticated access to manipulate platform data or compromise user accounts.

Description Summary:
Grav is susceptible to a Cross-site Scripting (XSS) vulnerability requiring user interaction, which could allow an authenticated attacker to gain high-impact control over the application.

Executive Summary:
A high-severity Cross-site Scripting vulnerability in Grav could allow authenticated attackers to gain unauthorized control over the application environment.

Vulnerability Details

CVE-ID: CVE-2026-42611

Affected Software: getgrav Grav

Affected Versions: < 2.0.0-beta.2

Vulnerability: This is a Cross-site Scripting (CWE-79) vulnerability that allows an authenticated attacker with low privileges to execute malicious scripts, facilitated by user interaction.

Business Impact

The CVSS score of 8.9 reflects the potential for significant technical impact, including unauthorized data access and potential system-wide compromise. Successful exploitation could lead to severe reputational damage and the loss of sensitive data, necessitating urgent remediation to protect the integrity of the Grav platform.

Remediation Plan

Immediate Action: Upgrade to Grav version 2.0.0-beta.2 or later to address this security flaw.

Proactive Monitoring: Monitor for anomalous user behavior and abnormal script execution patterns within the application logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block known XSS payloads and apply browser-based security headers to mitigate the risk of script execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly sensitive due to the potential for cross-site impact.

Analyst Recommendation

Given the high CVSS rating and the potential for severe impact, organizations should treat this as a critical update. Administrators must verify their current version and apply the patch to version 2.0.0-beta.2 immediately to prevent potential exploitation.

Description Summary:
Grav contains multiple authorization and privilege management vulnerabilities that allow authenticated users to bypass security controls and perform unauthorized actions.

Executive Summary:
Multiple authorization bypass vulnerabilities in Grav allow authenticated attackers to escalate privileges and perform unauthorized actions on the platform.

Vulnerability Details

CVE-ID: CVE-2026-42609

Affected Software: getgrav Grav

Affected Versions: < 2.0.0-beta.2

Vulnerability: This vulnerability involves improper privilege management (CWE-269), authorization (CWE-285), and authorization bypass through user-controlled keys (CWE-639), requiring authenticated access.

Business Impact

These vulnerabilities allow an attacker to bypass authorization logic, potentially leading to full system compromise or unauthorized modification of data. With a CVSS score of 8.1, the risk of privilege escalation is significant, potentially impacting the entire platform's security posture and administrative control.

Remediation Plan

Immediate Action: Update the Grav platform to version 2.0.0-beta.2 or later to resolve the authorization flaws.

Proactive Monitoring: Review audit logs for unauthorized access attempts or suspicious privilege escalation activity by standard users.

Compensating Controls: Restrict access to the application to trusted networks and ensure that administrative interfaces are not exposed to untrusted user roles.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of multiple authorization flaws makes this a high-risk target for privilege escalation.

Analyst Recommendation

The ability for authenticated users to bypass authorization mechanisms represents a critical security risk. Organizations must prioritize the upgrade to version 2.0.0-beta.2 to ensure that privilege and authorization controls are correctly enforced and to prevent unauthorized administrative actions.

Description Summary:
Grav CMS allows authenticated administrators to achieve Remote Code Execution (RCE) by uploading malicious ZIP files via the "Direct Install" tool.

Executive Summary:
A critical RCE vulnerability in Grav CMS allows an authenticated administrator to execute arbitrary code by bypassing file inspection during plugin installation.

Vulnerability Details

CVE-ID: CVE-2026-42607

Affected Software: Grav CMS

Affected Versions: Prior to 2.0.0-beta.2

Vulnerability: This is an RCE vulnerability involving the "Direct Install" tool. The tool fails to inspect the contents of uploaded ZIP files, allowing an attacker with administrative privileges to upload and execute a malicious plugin containing a web shell.

Business Impact

Successful exploitation results in full server-side code execution, granting the attacker control over the underlying web server. With a CVSS score of 9.1, this vulnerability is a high-impact risk for any organization using the affected CMS.

Remediation Plan

Immediate Action: Upgrade to Grav version 2.0.0-beta.2 or later.

Proactive Monitoring: Monitor the plugins directory for unauthorized files and review server logs for suspicious PHP execution.

Compensating Controls: Restrict administrative access to the "Direct Install" feature and enforce file system permissions to prevent the execution of files in the upload directory.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should prioritize upgrading to the latest version of Grav. Additionally, ensure that administrative accounts are secured with multi-factor authentication to prevent the initial access required to exploit this flaw.

Description Summary:
A path traversal vulnerability in Grav allows authenticated low-privileged users to read sensitive server files, including user account credentials and password reset tokens, via the Frontmatter form.

Executive Summary:
A path traversal vulnerability in Grav allows low-privileged users to compromise arbitrary accounts by accessing sensitive configuration files, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2025-66300

Affected Software: Grav Grav

Affected Versions: < 1.8.0-beta.27

Vulnerability: This flaw is a path traversal vulnerability (CWE-22) triggered through the Frontmatter form. It allows an authenticated user with page editing privileges to bypass directory restrictions and read sensitive files, such as YAML account files containing hashed credentials and 2FA secrets.

Business Impact

The ability to access sensitive account data poses a severe threat to organizational security. An attacker can use the harvested password reset tokens or cracked password hashes to achieve full account takeover, potentially leading to unauthorized administrative access, data theft, or total system compromise. Given the CVSS score of 8.5, this high-severity vulnerability must be prioritized to prevent unauthorized access to the application backend.

Remediation Plan

Immediate Action: Upgrade the Grav installation to version 1.8.0-beta.27 or later, as this version contains the necessary security patch to remediate the path traversal flaw.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the user account directory or attempts to access .yaml files via the Frontmatter interface.

Compensating Controls: If an immediate upgrade is not feasible, restrict access to the page editing functionality to trusted users only and implement strict egress filtering or WAF rules to detect and block path traversal patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on a logic flaw in file path validation rather than complex memory corruption.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity and confidentiality of the Grav platform. Administrators should immediately verify their current version and apply the 1.8.0-beta.27 update. Failure to patch allows even low-privileged users to escalate their access, making remediation a high-priority task for security teams.

Description Summary:
Grav CMS prior to 1.8.0-beta.27 contains a server-side template injection vulnerability allowing authenticated editors to execute arbitrary code by bypassing the system sandbox.

Executive Summary:
A critical server-side template injection vulnerability in Grav CMS allows authenticated users with editor permissions to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-66299

Affected Software: Grav Grav CMS

Affected Versions: < 1.8.0-beta.27

Vulnerability: The flaw exists due to improper neutralization of special elements within the Twig template engine, which fails to adequately sandbox objects. An authenticated user with editor-level privileges can inject malicious Twig directives to manipulate the attribute system, ultimately facilitating arbitrary code execution.

Business Impact

This vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for total system compromise. Successful exploitation grants an attacker full control over the web server, which could lead to unauthorized data access, modification of sensitive content, or the pivot point for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Grav CMS to version 1.8.0-beta.27 or later to implement the necessary sandbox protections.

Proactive Monitoring: Review administrative audit logs for unusual template modifications or unexpected system calls originating from the editor interface.

Compensating Controls: Restrict administrative and editor-level access to the CMS to only trusted personnel until the patch can be applied, and ensure the web server is running with the least privilege necessary.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of December 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows a low-privilege user to escalate their access to full system command execution.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a significant risk to the integrity and availability of the Grav CMS environment. Administrators must prioritize updating to version 1.8.0-beta.27 immediately to close the security gap and prevent unauthorized access.

Description Summary:
A privilege escalation vulnerability in the Grav Admin plugin allows authenticated users with create permissions to overwrite administrator accounts due to missing username uniqueness validation.

Executive Summary:
A critical privilege escalation vulnerability in Grav CMS allows authenticated attackers with limited permissions to hijack administrator accounts and gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-66296

Affected Software: Grav Grav CMS

Affected Versions: < 1.8.0-beta.27

Vulnerability: The flaw resides in the Admin plugin, specifically within the user creation logic, which fails to enforce uniqueness for usernames. An authenticated user with sufficient permissions to create accounts can register a new user using an existing administrator's username, effectively performing an account takeover.

Business Impact

Successful exploitation of this vulnerability results in full administrative compromise of the Grav CMS instance. This allows an attacker to execute arbitrary code, modify site content, exfiltrate sensitive data, or disrupt business operations. With a CVSS score of 8.8, this represents a high severity risk that directly threatens the integrity and availability of the platform.

Remediation Plan

Immediate Action: Update the Grav CMS installation to version 1.8.0-beta.27 or later to implement the necessary username validation checks.

Proactive Monitoring: Review administrative user logs for any suspicious account creation activities or unexpected changes to existing account credentials.

Compensating Controls: Restrict access to the administrative panel to trusted IP addresses or require multi-factor authentication for all administrative accounts to mitigate the impact of unauthorized access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user granted the capability to create new accounts, making it a high priority for administrative environments.

Analyst Recommendation

The ability for a low-privileged user to escalate to full administrative access poses an unacceptable risk to the security posture of the Grav CMS application. Organizations must prioritize applying the 1.8.0-beta.27 update immediately to resolve the flawed validation logic. Failure to patch this vulnerability leaves the system susceptible to complete account takeover and subsequent unauthorized administrative actions.

Description Summary:
A path traversal vulnerability in Grav allows an authenticated user with account creation privileges to write user YAML files to unauthorized locations, potentially leading to unauthorized account control.

Executive Summary:
A critical path traversal vulnerability in Grav allows authenticated administrators to overwrite arbitrary files, presenting a significant risk to system integrity and account security.

Vulnerability Details

CVE-ID: CVE-2025-66295

Affected Software: Grav

Affected Versions: < 1.8.0-beta.27

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) occurring in the Admin UI. It allows an authenticated user with user creation privileges to supply malicious path sequences in a username, causing the application to write account configuration files outside the designated directory.

Business Impact

The ability to write arbitrary YAML files allows an attacker to manipulate account fields, including password hashes and two-factor authentication secrets. Given the CVSS score of 8.8, this vulnerability poses a high risk of total account takeover and unauthorized administrative access. Successful exploitation could lead to full system compromise, unauthorized data access, and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Grav to version 1.8.0-beta.27 or later to resolve the path traversal flaw.

Proactive Monitoring: Review administrative user creation logs for irregular or malformed usernames that include directory traversal characters like dots or slashes.

Compensating Controls: Restrict administrative access to trusted personnel only and employ a Web Application Firewall (WAF) to filter incoming requests for path traversal patterns in the username field.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of December 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally exploitable due to insufficient input sanitization of the username parameter during account creation.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized administrative escalation. System administrators should verify their current Grav version and apply the patch to 1.8.0-beta.27 as a priority. Failure to remediate this issue leaves the application susceptible to account manipulation and potential full platform takeover.

Description Summary:
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint.

Executive Summary:
A critical unauthenticated remote code execution vulnerability in GravCMS 1.10.7 poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47812

Affected Software: Getgrav GravCMS

Affected Versions: 1.10.7

Vulnerability: This is an unauthenticated missing authorization flaw (CWE-862) within the scheduler endpoint, allowing attackers to inject malicious custom jobs and execute arbitrary system commands via base64-encoded PHP payloads.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve full remote code execution on the underlying server. Given the CVSS score of 7.5, this flaw presents a high risk to business operations, as it can lead to total data exfiltration, unauthorized system control, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade GravCMS to the latest version immediately to resolve the authorization flaw in the scheduler component.

Proactive Monitoring: Review web server and application logs for suspicious POST requests targeting the /admin/config/scheduler endpoint, especially those containing base64-encoded strings or references to command execution functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the administration panel and sanitize input parameters associated with the scheduler tool.

Exploitation Status

Public Exploit Available: Yes, a functional exploit script is available via ExploitDB (EDB-ID 49973).

Analyst Notes: As of January 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public exploit script significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

The vulnerability in GravCMS 1.10.7 is severe due to the lack of required authentication for critical administrative functions. Organizations running this version must prioritize patching to prevent potential remote code execution. If patching is not immediately feasible, restrict access to the /admin interface to trusted network segments to mitigate the risk of unauthorized exploitation.