Composer getgrav/grav has 99 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-27921 | Grav File Upload Path Traversal | high | 8.8 | <1.7.45 | 1.7.45 |
| CVE-2021-29440 | Grav's Twig processing allowing dangerous PHP functions by default | high | 8.4 | <1.7.11 | 1.7.11 |
| CVE-2022-2073 | Code injection in grav | high | 7.2 | <1.7.34 | 1.7.34 |
| CVE-2020-11529 | Open Redirect in Grav | medium | 6.1 | <1.6.23 | 1.6.23 |
| CVE-2024-28116 | Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass | high | 8.8 | <1.7.45 | 1.7.45 |
| CVE-2026-61450 | Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) | medium | 6.5 | <2.0.2 | 2.0.2 |
| CVE-2023-34448 | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | <1.7.42 | 1.7.42 |
| CVE-2026-42607 | Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature | critical | 9.1 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2021-3924 | Path traversal in grav | high | 8.8 | <=1.7.24 | – |
| CVE-2018-5233 | Grav CMS Cross-site scripting (XSS) vulnerability | medium | 6.1 | <1.3.0 | 1.3.0 |
| CVE-2024-34082 | Grav Vulnerable to Arbitrary File Read to Account Takeover | high | 8.5 | <1.7.46 | 1.7.46 |
| CVE-2020-29555 | Grav CMS Arbitrary File Deletion | high | 8.1 | >=1.7.0-beta.1 and <=1.7.0-rc.17 or <1.6.30 | 1.6.30 |
| CVE-2025-66294 | Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass | high | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2023-37897 | grav Server-side Template Injection (SSTI) mitigation bypass | high | 7.2 | <1.7.42.2 | 1.7.42.2 |
| CVE-2026-56700 | Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass | critical | 0.0 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2021-3818 | Reliance on Cookies without Validation and Integrity Checking in getgrav/grav | medium | 6.3 | <1.7.21 | 1.7.21 |
| CVE-2023-34251 | Grav Server Side Template Injection (SSTI) vulnerability | critical | 9.1 | <1.7.42 | 1.7.42 |
| CVE-2023-34252 | Grav Server-side Template Injection (SSTI) via Twig Default Filters | high | 7.2 | <1.7.42 | 1.7.42 |
| CVE-2023-34253 | Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability | high | 7.2 | <1.7.42 | 1.7.42 |
| CVE-2022-0970 | Stored Cross-site Scripting in grav | high | 7.1 | <1.7.31 | 1.7.31 |
| CVE-2024-28119 | Server Side Template Injection (SSTI) via Twig escape handler | high | 8.8 | <1.7.45 | 1.7.45 |
| CVE-2022-1173 | Stored cross site scripting in getgrav/grav | medium | 5.4 | <1.7.33 | 1.7.33 |
| CVE-2019-16126 | Cross-site Scripting in Grav | medium | 6.1 | <1.7.0-beta.8 | 1.7.0-beta.8 |
| CVE-2022-0268 | Cross-site Scripting in grav | medium | 5.7 | <1.7.28 | 1.7.28 |
| CVE-2024-28117 | Server Side Template Injection (SSTI) | high | 8.8 | <1.7.45 | 1.7.45 |
| CVE-2022-0743 | Cross site scripting in getgrav/grav | medium | 4.6 | <1.7.31 | 1.7.31 |
| CVE-2020-29553 | Grav CMS Cross-Site Request Forgery (CSRF) | high | 8.8 | >=1.7.0-beta.1 and <=1.7.0-rc.17 or <1.6.30 | 1.6.30 |
| CVE-2024-27923 | Remote Code Execution by uploading a phar file using frontmatter | high | 8.8 | <1.7.43 | 1.7.43 |
| CVE-2025-66301 | Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions | high | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2024-28118 | Server Side Template Injection (SSTI) | high | 8.8 | <1.7.45 | 1.7.45 |
| CVE-2026-42613 | Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access | critical | 9.4 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-65608 | Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation | high | 8.8 | >=1.7.0 and <2.0.9 | 2.0.9 |
| CVE-2023-31506 | Cross-site scripting (XSS) vulnerability in Grav | medium | 5.4 | all versions | – |
| CVE-2020-29556 | Grav CMS Local File Injection | medium | 5.5 | >=1.7.0-beta.1 and <=1.7.0-rc.17 or <1.6.30 | 1.6.30 |
| CVE-2026-72819 | Grav CMS vulnerable to remote code execution via .zip file upload | high | 8.8 | <2.0.13 | 2.0.13 |
| CVE-2026-75827 | Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write | high | 8.8 | <2.0.15 | 2.0.15 |
| CVE-2025-66297 | Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection | high | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-72695 | Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion | high | 8.1 | <2.0.16 | 2.0.16 |
| CVE-2025-66299 | Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) | high | 8.8 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-42608 | Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component | high | 0.0 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-59193 | Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() | medium | 4.9 | >=1.0.0 and <2.0.0 | 2.0.0 |
| CVE-2021-3904 | Cross-Site Scripting in grav | medium | 6.3 | <1.7.24 | 1.7.24 |
| CVE-2025-66295 | Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption | high | 8.8 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-53653 | Grav: Unauthenticated denial of service via unbounded image derivative dimensions | high | 0.0 | >=2.0.0-beta.1 and <2.0.0-rc.8 or <1.7.53 | 2.0.0-rc.8, 1.7.53 |
| CVE-2026-55890 | Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr | medium | 4.8 | <2.0.0-rc.9 | 2.0.0-rc.9 |
| CVE-2026-75837 | Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin | critical | 9.1 | <2.0.14 | 2.0.14 |
| CVE-2025-66302 | Grav vulnerable to Path Traversal allowing server files backup | medium | 6.8 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-64850 | Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | high | 0.0 | <2.0.7 | 2.0.7 |
| CVE-2026-42609 | Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic | high | 8.1 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-69089 | Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images | high | 0.0 | >=2.0.10 and <2.0.11 | 2.0.11 |
| CVE-2025-66300 | Grav is vulnerable to Arbitrary File Read | high | 8.5 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-74907 | Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) | medium | 5.9 | <2.0.15 | 2.0.15 |
| CVE-2026-42841 | Grav CMS vulnerable to stored XSS via Markdown media attribute() action | medium | 4.8 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-86197 | Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super | medium | 0.0 | <2.0.20 | 2.0.20 |
| CVE-2025-66304 | Grav Exposes Password Hashes Leading to privilege escalation | medium | 6.2 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-72698 | Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths | medium | 6.5 | <2.0.16 | 2.0.16 |
| CVE-2026-75828 | Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS | high | 8.7 | <2.0.15 | 2.0.15 |
| CVE-2024-35498 | Grav Cross-site Scripting vulnerability | low | 0.0 | <=1.7.45 | – |
| CVE-2025-66303 | Grav is vulnerable to a DOS on the admin panel | medium | 4.9 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-66305 | Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter | high | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-62230 | Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems | high | 0.0 | <2.0.4 | 2.0.4 |
| CVE-2025-66298 | Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms | high | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-72697 | Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content | medium | 6.5 | <2.0.16 | 2.0.16 |
| CVE-2026-62232 | Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge | high | 7.4 | <2.0.4 | 2.0.4 |
| CVE-2026-75831 | Grav: Stored XSS via Markdown audio/video media <source> URL | high | 7.6 | <2.0.15 | 2.0.15 |
| CVE-2026-76839 | Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via | high | 7.7 | <2.0.16 | 2.0.16 |
| CVE-2026-42844 | Low-privileged Grav API users can create super-admin accounts via blueprint-upload | high | 0.0 | <2.0.0-beta.4 | 2.0.0-beta.4 |
| CVE-2026-44737 | Grav: Stored XSS via page title (data[header][title]) in admin panel | medium | 0.0 | <1.7.49.5 | 1.7.49.5 |
| CVE-2025-66296 | Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover | high | 8.8 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-66307 | Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure | medium | 6.5 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-72832 | Grav: Stored XSS via quoted-attribute bypass in detectXss | medium | 5.4 | >=1.5.2 and <2.0.13 | 2.0.13 |
| CVE-2026-76846 | Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when co | high | 7.5 | <2.0.16 | 2.0.16 |
| CVE-2026-56701 | Grav is Vulnerable to XXE via SVG Upload | medium | 6.5 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-61455 | Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits | medium | 6.5 | <2.0.1 | 2.0.1 |
| CVE-2026-62237 | Grav: Authenticated ReDoS via regex_replace in Twig Sandbox | medium | 0.0 | <2.0.4 | 2.0.4 |
| CVE-2026-42611 | Grav is Vulnerable to Stored XSS via Tag Injection | high | 8.9 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-61449 | Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer | medium | 6.5 | >=2.0.1 and <2.0.2 | 2.0.2 |
| CVE-2026-69088 | Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | high | 8.1 | >=2.0.7 and <2.0.11 | 2.0.11 |
| CVE-2025-66306 | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel | medium | 4.3 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-66844 | Grav may be vulnerable to SSRF attack via Twig Templates | critical | 9.1 | <=1.7.49.5 | – |
| CVE-2026-42610 | Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass | medium | 6.5 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2020-37256 | Cross-Site Scripting in Grav | medium | 0.0 | <1.6.30 | 1.6.30 |
| CVE-2026-44738 | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() | high | 7.7 | <2.0.0-rc.2 | 2.0.0-rc.2 |
| CVE-2026-58657 | Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav | medium | 4.8 | >=2.0.0-rc.9 and <2.0.0 | 2.0.0 |
| CVE-2026-75834 | Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate | medium | 5.4 | <2.0.14 | 2.0.14 |
| CVE-2026-42612 | Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes | high | 8.5 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2025-66309 | Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in | medium | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-65186 | Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor | medium | 6.1 | <=1.7.49 | – |
| CVE-2026-7317 | Grav has Insecure Deserialization in File Cache | medium | 5.0 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2026-72701 | Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection | low | 3.7 | <2.0.16 | 2.0.16 |
| CVE-2026-55885 | Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets | medium | 6.8 | <1.7.53 | 1.7.53 |
| CVE-2025-66308 | Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` | medium | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-66310 | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab | medium | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2025-66311 | Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters | medium | 0.0 | <1.11.0-beta.1 | 1.11.0-beta.1 |
| CVE-2025-66312 | Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName] | medium | 0.0 | <1.8.0-beta.27 | 1.8.0-beta.27 |
| CVE-2026-61453 | Grav: XSS Blueprint Validation Bypass via Twig String Concatenation | medium | 0.0 | >=2.0.0 and <2.0.1 | 2.0.1 |
| CVE-2026-42842 | Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel | medium | 5.4 | <2.0.0-beta.2 | 2.0.0-beta.2 |
| CVE-2025-66843 | Grav is vulnerable to Stored XSS through authenticated user-edited content | medium | 5.4 | <=1.7.49.5 | – |
| CVE-2026-72702 | Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match | low | 0.0 | <2.0.16 | 2.0.16 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked