Vulnerabilities in getgrav
211 resultsCVE-2026-112782HIGHGrav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of ServiceEPSS 0.8%CVE-2026-72830HIGHGrav API Plugin before 1.0.13 RCE via ConfigController scope bypassEPSS 0.7%CVE-2026-42845HIGHGrav: Anonymous Page Content Overwrite via Form File Upload filename OverrideEPSS 0.7%CVE-2026-72824HIGHGrav before 1.0.13 API Key Scope Bypass via PagesControllerEPSS 0.7%CVE-2026-112780CRITICALGrav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@EPSS 0.7%CVE-2026-75574HIGHGrav before 4.2.2 Remote Code Execution via Email TwigEPSS 0.7%CVE-2025-66299HIGHSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMSEPSS 0.7%CVE-2026-62666HIGHGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of superEPSS 0.6%CVE-2026-72695HIGHGrav before 2.0.16 Path Traversal via MediaUploadTrait deleteFileEPSS 0.6%CVE-2020-36955MEDIUMGrav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site ScriptingEPSS 0.6%CVE-2026-114659HIGHGrav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesEPSS 0.6%CVE-2026-85603HIGHGrav Admin Plugin Path Traversal via Save As Language CodeEPSS 0.6%CVE-2026-112781HIGHGrav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ DirectivesEPSS 0.6%CVE-2026-61457MEDIUMGrav before 1.0.3 Remote Code Execution via File Upload Extension BypassEPSS 0.6%CVE-2026-42608HIGHGrav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.EPSS 0.6%CVE-2026-59193MEDIUMGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()EPSS 0.6%CVE-2023-34452MEDIUMGrav vulnerable to Self Cross Site Scripting in /forgot_passwordEPSS 0.6%CVE-2021-3904MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 0.6%CVE-2025-66295HIGHGrav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System CorruptionEPSS 0.6%CVE-2026-100672HIGHgrav-plugin-comments before 1.2.11 Unauthenticated Information DisclosureEPSS 0.6%