Exposure of Grav

CMS
129
exposure score
737
sites use
0
exploited
8
critical
Vexday analysis

O CMS Grav acumula 46 CVEs catalogadas, com 13 surgidas nos últimos 90 dias — volume recente que indica atenção contínua da comunidade de pesquisa à superfície de ataque da plataforma. Nenhuma vulnerabilidade consta no catálogo KEV da CISA, taxa abaixo da média geral do catálogo, o que sugere ausência de exploração ativa confirmada até o momento, embora isso não elimine o risco. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão recorrente em aplicações de gerenciamento de conteúdo. A CVE mais preocupante no cenário atual é CVE-2024-27921, com EPSS de aproximadamente 0,61, indicando probabilidade relevante de exploração — equipes responsáveis por instâncias Grav devem priorizá-la nas verificações de atualização, especialmente considerando que há 3 CVEs de severidade crítica no portfólio total.

CVEs

89 results
CVE-2024-27921HIGHGrav File Upload Path Traversal vulnerabilityEPSS 60.6%CVE-2021-29440HIGHTwig allowing dangerous PHP functions by defaultEPSS 30.6%CVE-2024-28116HIGHServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypassEPSS 5.8%CVE-2023-34448HIGHGrav Server-side Template Injection (SSTI) via Twig Default FiltersEPSS 4.5%CVE-2026-42607CRITICALGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install FeatureEPSS 3.9%CVE-2024-34082HIGHGrav Arbitrary File Read to Account TakeoverEPSS 3.0%CVE-2025-66294HIGHGrav is vulnerable to RCE via SSTI through Twig Sandbox BypassEPSS 2.9%CVE-2023-37897HIGHServer-side Template Injection (SSTI) in gravEPSS 2.8%CVE-2023-34251CRITICALGrav Server Side Template Injection vulnerabilityEPSS 2.3%CVE-2023-34253HIGHGrav vulnerable to Server-side Template Injection (SSTI) via Denylist BypassEPSS 2.1%CVE-2023-34252HIGHGrav Server-side Template Injection via Insufficient Validation in filterFilterEPSS 2.1%CVE-2026-56700CRITICALGrav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command InjectionEPSS 1.7%CVE-2024-28119HIGHGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlerEPSS 1.6%CVE-2024-28117HIGHGrav vulnerable to Server Side Template Injection (SSTI)EPSS 1.4%CVE-2024-27923HIGHRemote Code Execution by uploading a phar file using frontmatterEPSS 1.4%CVE-2025-66301HIGHGrav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsEPSS 1.4%CVE-2024-28118HIGHGrav vulnerable to Server Side Template Injection (SSTI)EPSS 1.2%CVE-2026-58655HIGHGrav Flex Objects - Server-Side Template Injection via Dynamic TitlesEPSS 1.1%CVE-2026-42613CRITICALGrav: Privilege Escalation via Missing Server-Side Validation of groups/accessEPSS 0.9%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 0.8%