Skip to content
OpenAdvisories

Product · getgrav

grav

159 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-65008 Public exploit

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any a…

    getgrav grav
  • Critical 9.4
    CVE-2026-42613 Public exploit

    Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation. When registration is enabled and gr…

    getgrav grav getgrav/grav Packagist
  • Critical 9.1
    CVE-2026-42607 Public exploit

    Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the "Direct Install" tool. While the system attempts to bl…

    getgrav grav getgrav/grav Packagist