---METADATA---
VENDOR: Grav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav contains an information disclosure vulnerability within the Twig sandbox, allowing unauthenticated attackers to access restricted data through improper credential or sensitive information protection.

Executive Summary:
A critical information disclosure vulnerability in the Grav Twig sandbox allows unauthenticated remote attackers to gain unauthorized access to sensitive system information.

Vulnerability Details

CVE-ID: CVE-2026-76846

Affected Software: Grav Grav

Affected Versions: 0 up to (excluding) 2.0.16

Vulnerability: This vulnerability (CWE-522) involves insufficient protection of credentials or sensitive data within the Twig templating environment. Unauthenticated remote attackers can exploit this to bypass sandbox restrictions and retrieve information that should otherwise be inaccessible to them.

Business Impact

Successful exploitation results in the unauthorized disclosure of sensitive configuration data or user information stored within the Grav environment. This information can be leveraged to escalate privileges, facilitate further attacks, or compromise the underlying server infrastructure. Given the 7.5 CVSS score, this represents a significant threat to data privacy and system integrity.

Remediation Plan

Immediate Action: Update the Grav installation to version 2.0.16 or later, which includes the necessary security fixes for the Twig sandbox.

Proactive Monitoring: Audit access logs for unusual requests directed at template rendering functions or unexpected access to configuration-related files.

Compensating Controls: Ensure that the production environment follows the principle of least privilege, restricting file system access for the web server user to prevent the leakage of sensitive environment files.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The fix involves specific code changes in the Twig sandbox implementation to prevent unauthorized data access.

Analyst Recommendation

Information disclosure flaws in core templating engines can have wide-reaching consequences for application security. It is imperative to apply the provided update to version 2.0.16 to secure the Twig sandbox and prevent unauthorized data retrieval by unauthenticated actors.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: 0 up to 2.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A template engine injection vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via the Twig template engine.

Executive Summary:
A high-severity vulnerability in the Twig template engine within Grav CMS versions prior to 2.0.13 enables authenticated attackers to execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-72827

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability (CWE-1336) arises from the improper neutralization of special elements used in the Twig template engine. Authenticated attackers can leverage this flaw to manipulate templates and execute unauthorized code within the application context.

Business Impact

A CVSS score of 8.8 underscores the gravity of this issue, as it grants attackers the ability to compromise the integrity and confidentiality of the entire CMS installation. Unauthorized code execution can lead to full system takeover and persistent backdoors within the web application.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later to apply the necessary template engine security fixes.

Proactive Monitoring: Monitor template file changes and review server logs for unusual Twig engine errors or unauthorized code execution attempts.

Compensating Controls: Implement a Web Application Firewall with rules designed to detect and block malicious template injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Template injection is a common method for attackers to achieve code execution.

Analyst Recommendation

All Grav CMS instances must be updated to version 2.0.13 to remediate this vulnerability. Given the ease of potential exploitation via template manipulation, prompt patching is essential to maintain the security posture of the web environment.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: 0 up to 2.0.13
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper control of code generation vulnerability in Grav CMS allows authenticated attackers to execute arbitrary code via malicious ZIP file uploads.

Executive Summary:
A critical remote code execution vulnerability in Grav CMS versions prior to 2.0.13 permits authenticated users to gain unauthorized command execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-72819

Affected Software: Grav CMS

Affected Versions: 0 up to 2.0.13

Vulnerability: This vulnerability, categorized as CWE-94, involves improper control of code generation during the processing of ZIP file uploads. An authenticated user with sufficient privileges can upload a crafted archive to achieve remote code execution on the underlying server.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to the entire server environment. An attacker achieving remote code execution can steal sensitive data, modify application files, or pivot deeper into the corporate network, leading to significant reputational and financial damage.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.13 or later immediately.

Proactive Monitoring: Inspect server logs for suspicious file upload activity or unexpected execution of system commands by the web server user.

Compensating Controls: Ensure that the web application directory has restricted permissions and that the web server is configured to prevent the execution of scripts in upload directories.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Remote code execution flaws are high-value targets for attackers.

Analyst Recommendation

The risk of remote code execution requires immediate attention. Organizations utilizing Grav CMS must upgrade to the patched version 2.0.13 without delay to eliminate the underlying code injection vector.

---METADATA---
VENDOR: Grav
PRODUCT: grav-plugin-login
AFFECTED_VERSIONS: 0 up to (excluding) 3.9.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav login plugin is susceptible to timing attacks due to a non-constant time token comparison, which may allow unauthenticated attackers to infer valid security tokens.

Executive Summary:
An unauthenticated timing attack vulnerability in the Grav login plugin enables attackers to potentially bypass security controls by observing discrepancies in processing time.

Vulnerability Details

CVE-ID: CVE-2026-72700

Affected Software: Grav grav-plugin-login

Affected Versions: 0 up to (excluding) 3.9.1

Vulnerability: The vulnerability (CWE-208) exists due to the use of non-constant time comparison for security tokens. Unauthenticated remote attackers can leverage this observable timing discrepancy to perform statistical analysis, potentially revealing valid tokens and compromising authentication integrity.

Business Impact

Exploitation of this timing vulnerability can facilitate unauthorized access to the Grav administrative or user interface. By successfully predicting or brute-forcing tokens, an attacker could gain elevated access to the application, resulting in full system compromise or sensitive data exposure. The CVSS score of 7.5 underscores the high risk this poses to platform confidentiality.

Remediation Plan

Immediate Action: Update the grav-plugin-login component to version 3.9.1 or higher to ensure secure, constant-time token comparison.

Proactive Monitoring: Review application logs for repeated, high-frequency authentication attempts or suspicious patterns from specific IP addresses that might indicate a timing attack in progress.

Compensating Controls: Implement rate limiting on the login endpoint to increase the difficulty of performing the required number of requests to execute a successful timing attack.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. These types of attacks are technically sophisticated and require a stable network environment to measure timing differences accurately.

Analyst Recommendation

Timing attacks are often underestimated but pose a serious threat to authentication mechanisms. Administrators must update the affected plugin immediately to implement the constant-time comparison fix, thereby eliminating the underlying side-channel vulnerability.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: 0 up to 2.0.16
CONFIDENCE: high
MISSING: patch_status
---END_METADATA---

Description Summary:
Grav CMS contains an improper link resolution vulnerability, allowing local attackers to perform file operations via symbolic link following.

Executive Summary:
A high-severity vulnerability in Grav CMS allows local attackers to perform unauthorized file operations, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-72696

Affected Software: Grav Grav CMS

Affected Versions: 0 up to 2.0.16

Vulnerability: This vulnerability is caused by improper link resolution (CWE-59), which enables an attacker to manipulate file access by following symbolic links. The vulnerability is exploitable by an unauthenticated local user.

Business Impact

Successful exploitation allows an attacker to access, modify, or delete sensitive files on the host system, which could lead to unauthorized data disclosure or service disruption. With a CVSS score of 8.4, this flaw represents a significant risk to the integrity and availability of the server environment.

Remediation Plan

Immediate Action: Upgrade to Grav CMS version 2.0.16 or later to incorporate the security fix.

Proactive Monitoring: Monitor filesystem access logs for suspicious activity, particularly involving unexpected file creation or access patterns near the application root.

Compensating Controls: Ensure the application is running with the principle of least privilege, specifically restricting the web server user's ability to follow symbolic links or access files outside the designated web directory.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for local privilege escalation or sensitive data theft.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized local system access. Administrators must prioritize updating to version 2.0.16 to ensure the underlying file handling mechanism is secured against symlink exploitation.

---METADATA---
VENDOR: Grav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.16
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav versions before 2.0.16 are vulnerable to path traversal during file deletion operations within MediaUploadTrait, allowing authenticated users to access or remove unauthorized files.

Executive Summary:
An authenticated path traversal vulnerability in Grav versions before 2.0.16 permits attackers to manipulate or delete files on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72695

Affected Software: Grav

Affected Versions: 0 up to (excluding) 2.0.16

Vulnerability: This is a path traversal vulnerability (CWE-22) identified within the MediaUploadTrait component. Authenticated attackers can leverage this flaw to escape intended directory boundaries during file handling processes.

Business Impact

The ability to traverse directories and potentially delete files poses a severe risk to the integrity and availability of the Grav CMS instance. Given the CVSS score of 8.1, this vulnerability could be used by a malicious insider or a compromised account to cause significant operational disruption or data loss.

Remediation Plan

Immediate Action: Update the Grav CMS installation to version 2.0.16 or later to secure the file handling logic.

Proactive Monitoring: Review administrative audit logs for any unusual file management activity or attempts to access files outside of standard media directories.

Compensating Controls: Implement file system permissions that restrict the web server user to only the necessary directories, thereby limiting the scope of any potential traversal.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently limited by the requirement for authenticated access to the CMS administrative functions.

Analyst Recommendation

Maintaining the integrity of the Grav environment is critical for operational security. Administrators should prioritize upgrading to version 2.0.16 to mitigate this path traversal risk and protect against unauthorized file system modifications.

---METADATA---
VENDOR: Grav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav CMS is vulnerable to path traversal, which may allow an unauthenticated attacker to access restricted files on the server.

Executive Summary:
Grav CMS is susceptible to a path traversal vulnerability that could allow an unauthenticated attacker to read sensitive files on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-69089

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.11

Vulnerability: This is a path traversal vulnerability (CWE-22) that occurs when user-supplied input is not properly sanitized before being used in file system operations, specifically within the watermark functionality. An unauthenticated attacker can manipulate the path to traverse directories and access files outside of the intended directory.

Business Impact

Successful exploitation allows an attacker to retrieve sensitive configuration files, source code, or other restricted data stored on the web server. This unauthorized access can lead to complete system compromise or information disclosure, justifying the high severity CVSS score of 7.5.

Remediation Plan

Immediate Action: Update Grav CMS to version 2.0.11 or later to implement the necessary path sanitization fixes.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the watermark or image processing modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing malicious path traversal sequences before they reach the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via simple crafted HTTP requests.

Analyst Recommendation

Due to the existence of a proof-of-concept and the high risk of information disclosure, administrators must prioritize updating to Grav CMS version 2.0.11. Ensuring the application is patched is essential to protecting sensitive server-side data from unauthorized access.

---METADATA---
VENDOR: Grav
PRODUCT: API Plugin
AFFECTED_VERSIONS: 0 up to 1.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API Plugin contains an improper privilege management vulnerability that allows authenticated users to escalate privileges via invitations and groups.

Executive Summary:
An improper privilege management vulnerability in the Grav API Plugin allows authenticated users to perform unauthorized privilege escalation, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-65897

Affected Software: Grav API Plugin

Affected Versions: 0 up to 1.0.10

Vulnerability: This is a privilege management flaw (CWE-269) within the Grav API Plugin. The vulnerability requires the attacker to be authenticated as a lower-privileged user to exploit the API endpoints related to invitations and group management.

Business Impact

If exploited, this vulnerability allows a standard user to gain administrative or elevated access to the Grav platform. This compromise can lead to full system control, unauthorized data exfiltration, or complete platform takeover. The CVSS score of 8.8 reflects the high potential for total technical impact on the host application.

Remediation Plan

Immediate Action: Update the Grav API Plugin to version 1.0.10 or later immediately.

Proactive Monitoring: Review user account management logs for suspicious activities or unauthorized changes to user roles and group permissions.

Compensating Controls: Restrict access to the API plugin to trusted IP addresses or require additional multi-factor authentication for administrative actions if patching is delayed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly exploitable once an attacker has gained standard user access.

Analyst Recommendation

Privilege escalation vulnerabilities are critical and must be prioritized. Organizations should audit their current Grav API Plugin deployments and apply the provided patch to prevent unauthorized escalation and maintain the security posture of their CMS environment.

---METADATA---
VENDOR: Grav
PRODUCT: API Plugin
AFFECTED_VERSIONS: 0 up to 1.0.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API Plugin is susceptible to a missing authorization vulnerability that allows attackers to manipulate API functions due to broken access control.

Executive Summary:
A missing authorization vulnerability in the Grav API Plugin allows for unauthorized access to sensitive API functions, leading to potential integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-65895

Affected Software: Grav API Plugin

Affected Versions: 0 up to 1.0.10

Vulnerability: This is a missing authorization flaw (CWE-862) occurring within the Grav API Plugin. The vulnerability allows for broken access control where specific API functions are not properly protected, allowing unauthorized actors to perform actions they should not be permitted to execute.

Business Impact

Successful exploitation allows unauthorized users to perform sensitive operations via the API, which could lead to the modification of system configurations or content. With a CVSS score of 8.5, this vulnerability presents a high risk of integrity compromise, potentially leading to reputational damage or system instability.

Remediation Plan

Immediate Action: Update the Grav API Plugin to version 1.0.10 or later immediately.

Proactive Monitoring: Audit API request logs for unauthorized access attempts or unexpected modifications to site data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or unauthorized API requests to the Grav backend.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it bypasses standard authorization checks required for secure API usage.

Analyst Recommendation

Missing authorization in API components is a critical security gap. Administrators must ensure the Grav API Plugin is updated to the latest version to close this access control hole and prevent unauthorized manipulation of the application.

---METADATA---
VENDOR: Grav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav contains a Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests by exploiting unrestricted curl protocols.

Executive Summary:
A Server-Side Request Forgery vulnerability in Grav allows authenticated attackers to potentially compromise backend resources and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-62234

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) stemming from the use of unrestricted curl protocols. The vulnerability requires the attacker to be authenticated to the application to trigger the malicious request.

Business Impact

An SSRF vulnerability can be leveraged to bypass network segmentation, allowing an attacker to probe internal services, access sensitive cloud metadata, or interact with databases that are not exposed to the public internet. With a CVSS score of 8.1, this represents a significant risk of internal reconnaissance and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Grav to version 2.0.4 or later to implement necessary restrictions on curl protocols.

Proactive Monitoring: Review web server and application logs for outgoing requests to unexpected or internal IP addresses initiated by the application service.

Compensating Controls: Implement strict egress filtering on the host running the Grav application to prevent the server from initiating unauthorized connections to internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the web server has broad network reach.

Analyst Recommendation

The risk posed by SSRF vulnerabilities is high because they often serve as a gateway to deeper network penetration. Organizations should verify their current version of Grav and apply the patch immediately to prevent attackers from utilizing the application as a proxy for internal network exploitation.

---METADATA---
VENDOR: Grav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to 1.4.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav Flex Objects plugin is vulnerable to server-side template injection, allowing authenticated attackers to execute arbitrary code.

Executive Summary:
A server-side template injection flaw in the Grav Flex Objects plugin allows authenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-58655

Affected Software: Grav Grav

Affected Versions: 0 up to 1.4.0

Vulnerability: The Grav Flex Objects plugin is susceptible to code injection (CWE-94) via dynamic titles, which permits an authenticated attacker to perform server-side template injection. This allows for the execution of arbitrary code within the application context.

Business Impact

Rated at 8.8 on the CVSS scale, this vulnerability represents a severe threat to the integrity and availability of the Grav CMS. Successful exploitation enables an attacker to gain full control over the web server, leading to potential data theft, site defacement, or the deployment of persistent malware.

Remediation Plan

Immediate Action: Update the Grav Flex Objects plugin to version 1.4.0 or later to patch the template injection vulnerability.

Proactive Monitoring: Monitor server logs for unusual system calls or command execution attempts originating from the web application process.

Compensating Controls: Restrict administrative access to trusted personnel only and employ a Web Application Firewall to inspect and sanitize input fields for common template injection payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires authenticated access, which serves as a primary barrier to entry.

Analyst Recommendation

While this vulnerability requires authentication, the potential for remote code execution makes it a high-priority item. Administrators must update the affected plugin to version 1.4.0 immediately to prevent potential system-level compromise.

---METADATA---
VENDOR: Grav
PRODUCT: Grav
AFFECTED_VERSIONS: 0 up to (excluding) 3.9.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav is vulnerable to a host header injection flaw, allowing unauthenticated attackers to manipulate email invitation targets due to reliance on insecure reverse DNS resolution.

Executive Summary:
A critical host header injection vulnerability in Grav allows unauthenticated remote attackers to manipulate system-generated emails, posing a significant risk of social engineering or phishing.

Vulnerability Details

CVE-ID: CVE-2026-56709

Affected Software: Grav Grav

Affected Versions: 0 up to (excluding) 3.9.2

Vulnerability: This vulnerability (CWE-350) stems from the application's reliance on reverse DNS resolution for security-critical actions, specifically within the email invitation process. The flaw is exploitable by unauthenticated remote attackers who can influence the application logic via malicious host headers.

Business Impact

Successful exploitation allows attackers to redirect sensitive application-generated emails to unauthorized destinations. This compromise of communication integrity can lead to unauthorized account access, credential theft, or the distribution of malicious content to legitimate users, severely damaging organizational reputation. With a CVSS score of 7.5, this vulnerability represents a high-severity risk to system security.

Remediation Plan

Immediate Action: Update the Grav installation to version 3.9.2 or later to apply the necessary security patches.

Proactive Monitoring: Monitor outgoing email logs for unexpected recipient addresses or anomalous traffic patterns originating from the Grav mailer service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and sanitize the Host header in incoming HTTP requests to prevent injection attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the insecure handling of server-side environmental variables.

Analyst Recommendation

The reliance on insecure DNS resolution for security functions is a critical design flaw. Administrators should prioritize the update to version 3.9.2 immediately to neutralize this vector. Failure to patch leaves the platform vulnerable to manipulation of its automated messaging systems.

---METADATA---
VENDOR: Grav
PRODUCT: Grav Flex Objects plugin
AFFECTED_VERSIONS: 0 up to 1.4.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav Flex Objects plugin is vulnerable to a missing authorization flaw that allows authenticated users to access unauthorized data.

Executive Summary:
A missing authorization vulnerability in the Grav Flex Objects plugin allows authenticated attackers to perform unauthorized data access, posing a significant risk to information confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-56707

Affected Software: Grav Flex Objects plugin

Affected Versions: 0 up to 1.4.8

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862). An authenticated attacker with low privileges can exploit this flaw to access sensitive objects within the system.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to gain unauthorized access to sensitive data handled by the Flex Objects plugin. With a CVSS score of 7.7, this is a high-severity issue, as it permits lateral movement or data exfiltration from an otherwise restricted environment. Organizations relying on Grav for content or data management should prioritize this update to prevent potential data breaches.

Remediation Plan

Immediate Action: Update the Grav Flex Objects plugin to version 1.4.8 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of object access or unauthorized attempts to reach sensitive administrative endpoints.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter requests targeting the Flex Objects module if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an authorization logic error that requires a valid user session.

Analyst Recommendation

This vulnerability represents a significant lapse in access control. Administrators must ensure that the Grav Flex Objects plugin is patched to version 1.4.8 immediately to eliminate this authorization bypass vector and secure sensitive site data.

---METADATA---
VENDOR: Grav
PRODUCT: Grav API Plugin
AFFECTED_VERSIONS: < 1.0.0-beta.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in the Grav API Plugin allows unauthorized users to perform actions exceeding their intended permissions.

Executive Summary:
The Grav API Plugin is susceptible to an authorization bypass vulnerability, potentially allowing unauthorized access to sensitive site configuration and user data.

Vulnerability Details

CVE-ID: CVE-2026-42843

Affected Software: Grav Grav API Plugin

Affected Versions: < 1.0.0-beta.15

Vulnerability: This is an authorization flaw (CWE-863) within the RESTful API component. It allows an attacker to interact with site content, media, and system management functions without proper validation of user privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability presents a high risk of total system compromise. Unauthorized access to the Grav CMS through the API could result in data exfiltration, unauthorized modification of site configuration, and potential takeover of administrative accounts.

Remediation Plan

Immediate Action: Upgrade the Grav API Plugin to version 1.0.0-beta.15 or later immediately to resolve the authorization logic error.

Proactive Monitoring: Audit API access logs for unauthorized attempts to access administrative endpoints or system configuration files.

Compensating Controls: Restrict access to the API endpoints via IP whitelisting or disable the API plugin entirely if it is not required for current site operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of a Proof-of-Concept (PoC) increases the risk of near-term exploitation.

Analyst Recommendation

Administrators must verify their current plugin version and apply the update immediately. Given that this vulnerability allows for total system impact, failure to patch could lead to a complete compromise of the CMS.

---METADATA---
VENDOR: Grav
PRODUCT: Grav CMS
AFFECTED_VERSIONS: Prior to 2.0.0-beta.2
---END_METADATA---

Description Summary:
Grav CMS is vulnerable to an authentication bypass during user registration, allowing an unauthenticated user to assign themselves administrative privileges.

Executive Summary:
An unauthenticated attacker can gain full administrative control of a Grav CMS instance by exploiting a flaw in the user registration process.

Vulnerability Details

CVE-ID: CVE-2026-42613

Affected Software: Grav CMS

Affected Versions: Prior to 2.0.0-beta.2

Vulnerability: This is an authentication and privilege escalation vulnerability in the Login::register() method. The method fails to validate input for group and access fields, allowing any unauthenticated user to register with admin.super privileges.

Business Impact

This vulnerability allows an attacker to take over the entire content management system, leading to total loss of control over the website's content, users, and configuration. The 9.4 CVSS score reflects the high risk of complete platform takeover.

Remediation Plan

Immediate Action: Upgrade to Grav version 2.0.0-beta.2 or later.

Proactive Monitoring: Review the user list for unauthorized accounts with administrative roles and audit registration logs for anomalous activity.

Compensating Controls: If upgrading is not immediately possible, disable user registration functionality.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is essential. Organizations should update their Grav installation and conduct a thorough audit of their user base to ensure no unauthorized administrative accounts have been created.

---METADATA---
VENDOR: getgrav
PRODUCT: Grav
AFFECTED_VERSIONS: < 2.0.0-beta.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav contains multiple authorization and privilege management vulnerabilities that allow authenticated users to bypass security controls and perform unauthorized actions.

Executive Summary:
Multiple authorization bypass vulnerabilities in Grav allow authenticated attackers to escalate privileges and perform unauthorized actions on the platform.

Vulnerability Details

CVE-ID: CVE-2026-42609

Affected Software: getgrav Grav

Affected Versions: < 2.0.0-beta.2

Vulnerability: This vulnerability involves improper privilege management (CWE-269), authorization (CWE-285), and authorization bypass through user-controlled keys (CWE-639), requiring authenticated access.

Business Impact

These vulnerabilities allow an attacker to bypass authorization logic, potentially leading to full system compromise or unauthorized modification of data. With a CVSS score of 8.1, the risk of privilege escalation is significant, potentially impacting the entire platform's security posture and administrative control.

Remediation Plan

Immediate Action: Update the Grav platform to version 2.0.0-beta.2 or later to resolve the authorization flaws.

Proactive Monitoring: Review audit logs for unauthorized access attempts or suspicious privilege escalation activity by standard users.

Compensating Controls: Restrict access to the application to trusted networks and ensure that administrative interfaces are not exposed to untrusted user roles.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The combination of multiple authorization flaws makes this a high-risk target for privilege escalation.

Analyst Recommendation

The ability for authenticated users to bypass authorization mechanisms represents a critical security risk. Organizations must prioritize the upgrade to version 2.0.0-beta.2 to ensure that privilege and authorization controls are correctly enforced and to prevent unauthorized administrative actions.

Executive Summary:
A high-severity vulnerability has been identified in multiple Grav products, a file-based web platform. Successful exploitation of this vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code on the server, leading to a complete system compromise. This could result in data theft, website defacement, or the installation of malware on the affected web server.

Vulnerability Details

CVE-ID: CVE-2025-66295

Affected Software: Grav Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists due to improper input sanitization within the file processing component of the Grav platform. An unauthenticated remote attacker can upload a specially crafted file (e.g., an image or markdown document containing embedded malicious code). When the Grav server processes this file, the malicious code is not properly neutralized and is executed with the permissions of the web server process, resulting in Remote Code Execution (RCE).

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit would grant an attacker full control over the affected web server, posing a significant risk to the organization. Potential consequences include the theft of sensitive data stored on the server, disruption of web services, reputational damage from a public-facing compromise, and financial losses associated with incident response and recovery. The compromised server could also be used as a pivot point to launch further attacks against the internal network.

Remediation Plan

Immediate Action:

• Identify all internet-facing systems running vulnerable versions of Grav products.
• Apply the security updates provided by the vendor immediately to mitigate the vulnerability.
• After patching, review web server access logs, application logs, and file systems for any indicators of compromise, such as suspicious file uploads or unexpected outbound network connections.

Proactive Monitoring:

• Monitor web server logs for unusual POST requests, especially those related to file uploads to unexpected endpoints.
• Implement file integrity monitoring (FIM) to alert on any unauthorized changes to Grav core files or content directories.
• Scrutinize outbound network traffic from the web server for connections to unusual IP addresses or ports, which could indicate a successful compromise.

Compensating Controls:

• If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to block the specific attack patterns associated with this vulnerability.
• Restrict file upload functionality to trusted users only or temporarily disable it if the business function is non-essential.
• Ensure the web server is running with the principle of least privilege and is properly segmented from critical internal network resources to limit the potential impact of a breach.

Exploitation Status

Public Exploit Available: false

Analyst Notes:
As of December 1, 2025, there are no known public exploits available for this vulnerability. However, given the high-severity rating and low attack complexity, it is highly probable that proof-of-concept (PoC) exploits will be developed and released by security researchers and threat actors in the near future. Organizations should assume that exploitation is imminent.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the risk of Remote Code Execution, this vulnerability presents a critical threat to the organization. Although CVE-2025-66295 is not currently listed on the CISA KEV catalog, its severity makes it a prime target for opportunistic and targeted attacks. We strongly recommend that all system owners prioritize the immediate application of vendor-supplied patches to all affected Grav installations to prevent a potential system compromise.