Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-api

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-112779

    Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

    Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destinatio…

    getgrav grav-plugin-api
  • Critical 9.4
    CVE-2026-62668

    Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

    Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php…

    getgrav grav grav-plugin-api
  • Critical 9.6
    CVE-2026-61451

    Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url

    The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and nev…

    getgrav grav-plugin-api