Skip to content
OpenAdvisories

Vendor

getgrav

212 known vulnerabilities.

Products

grav 158 grav-plugin-api 18 getgrav/grav 8 grav-plugin-login 7 grav-plugin-form 5 grav-plugin-admin 3 grav-plugin-shortcode-core 2 getgrav/grav-plugin-admin 2 grav-plugin-flex-objects 2 grav-plugin-guestbook 2 grav-plugin-comments 1 grav-plugin-data-manager 1 grav-plugin-star-ratings 1 grav-plugin-login-oauth 1 Grav CMS Admin Plugin 1 grav-plugin-datamanager 1 grav-plugin-admin2 1 GravCMS 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-65008 Public exploit

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any a…

    getgrav grav
  • Critical 9.4
    CVE-2026-42613 Public exploit

    Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and gr…

    getgrav grav getgrav/grav Packagist
  • Critical 9.1
    CVE-2026-42607 Public exploit

    Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to bl…

    getgrav grav getgrav/grav Packagist
  • Critical 9.3
    CVE-2021-21425 Public exploit EPSS 80%

    Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

    Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Partic…

    getgrav grav-plugin-admin