getgrav/grav (Packagist)
Advisories
126
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.0.20 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require getgrav/grav:^2.0.20Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-crrc-vpp2-f5x7 Duplicate Advisory: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled Withdrawn |
High | all versions | No fix yet |
| GHSA-8vp7-8q4w-vv7m Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet() Withdrawn |
Medium | all versions | No fix yet |
| GHSA-rj4c-4q9x-543x Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content Withdrawn |
Medium | all versions | No fix yet |
| GHSA-qh7h-6c7g-x8m6 Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match Withdrawn |
Medium | all versions | No fix yet |
| GHSA-mw85-cjh9-8hp7 Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths Withdrawn |
Medium | all versions | No fix yet |
| GHSA-px9v-979x-qmh9 Duplicate Advisory: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection Withdrawn |
Low | all versions | No fix yet |
| GHSA-896w-cw95-xq7w Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion Withdrawn |
High | all versions | No fix yet |
| GHSA-xjw5-q542-3vmr Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled |
High EPSS 0.30% |
< 2.0.16 | 2.0.16 |
| GHSA-3jhr-mxmx-38cx Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet() |
Medium EPSS 0.34% |
< 2.0.16 | 2.0.16 |
| GHSA-9ccq-2jfg-qw33 Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match |
Critical EPSS 0.15% |
< 2.0.16 | 2.0.16 |
| GHSA-38p6-h87p-r4cg Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection |
Medium EPSS 0.22% |
< 2.0.16 | 2.0.16 |
| GHSA-p597-crqc-m349 Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths |
Medium EPSS 0.41% |
< 2.0.16 | 2.0.16 |
| GHSA-47ch-6w46-6xm7 Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content |
Medium EPSS 0.38% |
< 2.0.16 | 2.0.16 |
| GHSA-jq29-c7v8-rg55 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion |
High EPSS 0.63% |
< 2.0.16 | 2.0.16 |
| GHSA-8hgv-xc77-jmcr Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin |
Medium EPSS 0.41% |
< 2.0.20 | 2.0.20 |
| GHSA-9pr6-8r9w-wvmj Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS Withdrawn |
High | all versions | No fix yet |
| GHSA-fwwx-3362-3947 Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write Withdrawn |
High | all versions | No fix yet |
| GHSA-q8cg-5m48-5c25 Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media <source> URL Withdrawn |
High | all versions | No fix yet |
| GHSA-993v-76jg-67xr Duplicate Advisory: Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate Withdrawn |
Medium | all versions | No fix yet |
| GHSA-m97h-2qj3-5773 Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin Withdrawn |
Critical | all versions | No fix yet |
| GHSA-2rhw-8953-48q3 Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) Withdrawn |
Medium | all versions | No fix yet |
| GHSA-xhfv-7758-r9hx Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin |
Critical EPSS 0.49% |
< 2.0.14 | 2.0.14 |
| GHSA-q2j8-x8hf-63ch Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate |
Medium EPSS 0.26% |
< 2.0.14 | 2.0.14 |
| GHSA-6qw9-4vv5-jr97 Grav: Stored XSS via Markdown audio/video media <source> URL |
High EPSS 0.35% |
< 2.0.15 | 2.0.15 |
| GHSA-vfmf-q6x9-cw96 Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS |
High EPSS 0.39% |
< 2.0.15 | 2.0.15 |
| GHSA-f8wv-xp27-6gq7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write |
High EPSS 0.86% |
< 2.0.15 | 2.0.15 |
| GHSA-4v9q-p283-qc2m Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) |
Medium EPSS 0.43% |
< 2.0.15 | 2.0.15 |
| GHSA-cgvr-f65r-pjv3 Duplicate Advisory: Grav: Stored XSS via quoted-attribute bypass in detectXss Withdrawn |
Medium | >= 1.5.2, <= 2.0.12 | No fix yet |
| GHSA-wvxr-6v52-gfmh Duplicate Advisory: Remote code execution via .zip file upload in Grav CMS Withdrawn |
High | all versions | No fix yet |
| GHSA-269c-h76q-8cxw Grav: Stored XSS via quoted-attribute bypass in detectXss |
Medium EPSS 0.31% |
>= 1.5.2, < 2.0.13 | 2.0.13 |
| GHSA-r94f-hx44-8jqf Grav CMS vulnerable to remote code execution via .zip file upload |
High EPSS 0.90% |
< 2.0.13 | 2.0.13 |
| GHSA-mmwh-j75q-gxp8 Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images Withdrawn |
High | No fix yet | |
| GHSA-vj8j-973f-r65j Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure Withdrawn |
High | >= 2.0.7, <= 2.0.10 | No fix yet |
| GHSA-w3f4-8pj2-599w Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images |
High EPSS 0.46% |
>= 2.0.10, < 2.0.11 | 2.0.11 |
| GHSA-7pgq-cr25-xvc8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure |
High EPSS 0.29% |
>= 2.0.7, < 2.0.11 | 2.0.11 |
| GHSA-pp9r-ppc4-25w4 Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation Withdrawn |
High | >= 1.7.0 | No fix yet |
| GHSA-c4wf-2xxc-68qm Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation |
High EPSS 1.12% |
>= 1.7.0, < 2.0.9 | 2.0.9 |
| GHSA-fj2p-qj2f-74v5 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() |
Critical EPSS 2.49% |
< 2.0.7 | 2.0.7 |
| GHSA-37f3-6p89-6qr9 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox |
Medium EPSS 0.38% |
< 2.0.4 | 2.0.4 |
| GHSA-7mgc-c7pq-3rr3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge |
Critical EPSS 0.50% |
< 2.0.4 | 2.0.4 |
| GHSA-vwg3-w8w3-pc79 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems |
High EPSS 0.54% |
< 2.0.4 | 2.0.4 |
| GHSA-373m-p57p-8665 Duplicate Advisory: Grav: XSS Blueprint Validation Bypass via Twig String Concatenation Withdrawn |
Medium | No fix yet | |
| GHSA-v626-428r-43p8 Duplicate Advisory: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer Withdrawn |
Medium | No fix yet | |
| GHSA-2c4f-86xc-cr74 Grav: XSS Blueprint Validation Bypass via Twig String Concatenation |
Medium EPSS 0.20% |
>= 2.0.0, < 2.0.1 | 2.0.1 |
| GHSA-8h9x-89f2-m7x3 Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer |
High EPSS 0.30% |
>= 2.0.1, < 2.0.2 | 2.0.2 |
| GHSA-2vcx-h8p2-9pg9 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() |
Medium EPSS 0.60% |
>= 1.0.0, < 2.0.0 | 2.0.0 |
| GHSA-4x9g-vw65-vvf9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions |
High EPSS 0.52% |
>= 2.0.0-beta.1, < 2.0.0-rc.8 | 2.0.0-rc.8 |
| GHSA-4x9g-vw65-vvf9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions |
High EPSS 0.52% |
< 1.7.53 | 1.7.53 |
| GHSA-928x-9mpw-8h56 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits |
High EPSS 0.53% |
< 2.0.1 | 2.0.1 |
| GHSA-mc5q-6hpj-rp7j Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) |
High EPSS 5.42% |
< 2.0.2 | 2.0.2 |
| GHSA-4wj4-79rr-pvff Duplicate Advisory: Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav Withdrawn |
Medium | No fix yet | |
| GHSA-ffmg-hfvg-jhg9 Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav |
Medium EPSS 0.27% |
>= 2.0.0-rc.9, < 2.0.0 | 2.0.0 |
| GHSA-32fw-h446-j4hh Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload Withdrawn |
Medium | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-pmf8-g7c8-7v54 Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr |
Medium EPSS 0.50% |
< 2.0.0-rc.9 | 2.0.0-rc.9 |
| GHSA-2f86-9cp8-6hcf Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets |
Medium EPSS 0.21% |
< 1.7.53 | 1.7.53 |
| GHSA-j274-39qw-32c9 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() |
High EPSS 0.28% |
< 2.0.0-rc.2 | 2.0.0-rc.2 |
| GHSA-fmg2-f5r9-24qc Grav: Stored XSS via page title (data[header][title]) in admin panel |
Medium EPSS 0.32% |
< 1.7.49.5 | 1.7.49.5 |
| GHSA-6xx2-m8wv-756h Low-privileged Grav API users can create super-admin accounts via blueprint-upload |
High EPSS 0.34% |
< 2.0.0-beta.4 | 2.0.0-beta.4 |
| GHSA-w8cg-7jcj-4vv2 Grav is Vulnerable to Stored XSS via Tag Injection |
High EPSS 0.30% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-3446-6mgw-f79p Grav is Vulnerable to XXE via SVG Upload |
High EPSS 0.30% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-hmcx-ch82-3fv2 Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component |
Critical EPSS 0.60% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-rr73-568v-28f8 Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic |
High EPSS 0.46% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-vj3m-2g9h-vm4p Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass |
Critical EPSS 2.53% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-9695-8fr9-hw5q Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes |
Medium EPSS 0.24% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-3f29-pqwf-v4j4 Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass |
Medium EPSS 0.29% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-pxm6-mhxr-q4mj Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access |
Critical EPSS 1.14% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-c2q3-p4jr-c55f Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel |
Medium EPSS 0.18% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-r7fx-8g49-7hhr Grav CMS vulnerable to stored XSS via Markdown media attribute() action |
Medium EPSS 0.42% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-w48r-jppp-rcfw Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature |
Critical EPSS 4.38% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-j7rw-325j-2rmx Duplicate Advisory: Grav has Insecure Deserialization in File Cache Withdrawn |
Medium | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-gwfr-jfjf-92vv Grav has Insecure Deserialization in File Cache |
Medium EPSS 0.22% |
< 2.0.0-beta.2 | 2.0.0-beta.2 |
| GHSA-729w-j79f-2c34 Grav may be vulnerable to SSRF attack via Twig Templates |
Critical EPSS 0.29% |
<= 1.7.49.5 | No fix yet |
| GHSA-mh85-44c2-3m97 Grav is vulnerable to Stored XSS through authenticated user-edited content |
Medium EPSS 0.16% |
<= 1.7.49.5 | No fix yet |
| GHSA-cchq-397m-q2qm Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor |
Medium EPSS 0.22% |
<= 1.7.49 | No fix yet |
| GHSA-rmw5-f87r-w988 Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` |
Medium EPSS 0.21% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-mpjj-4688-3fxg Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters |
Medium EPSS 0.21% |
< 1.11.0-beta.1 | 1.11.0-beta.1 |
| GHSA-7g78-5g5g-mvfj Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab |
Medium EPSS 0.21% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-65mj-f7p4-wggq Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab |
Medium EPSS 0.23% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-gqxx-248x-g29f Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` |
Medium EPSS 0.21% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-q3qx-cp62-f6m7 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure |
Medium EPSS 0.32% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-4cwq-j7jv-qmwg Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel |
Medium EPSS 0.29% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-m8vh-v6r6-w7p6 Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter |
Medium EPSS 0.39% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-gq3g-666w-7h85 Grav Exposes Password Hashes Leading to privilege escalation |
High EPSS 0.41% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-x62q-p736-3997 Grav is vulnerable to a DOS on the admin panel |
Medium EPSS 0.39% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-j422-qmxp-hv94 Grav vulnerable to Path Traversal allowing server files backup |
Medium EPSS 0.48% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-v8x2-fjv7-8hjh Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions |
Critical EPSS 1.34% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-p4ww-mcp9-j6f2 Grav is vulnerable to Arbitrary File Read |
High EPSS 0.45% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-gjc5-8cfh-653x Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) |
High EPSS 0.61% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-8535-hvm8-2hmv Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms |
High EPSS 0.38% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-858q-77wx-hhx6 Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection |
High EPSS 0.78% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-cjcp-qxvg-4rjm Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover |
High EPSS 0.32% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-h756-wh59-hhjv Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption |
High EPSS 0.55% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-662m-56v4-3r8f Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass |
High EPSS 2.82% |
< 1.8.0-beta.27 | 1.8.0-beta.27 |
| GHSA-m78c-qx99-mvw9 Grav Cross-site Scripting vulnerability |
Medium EPSS 0.39% |
<= 1.7.45 | No fix yet |
| GHSA-f8v5-jmfh-pr69 Grav Vulnerable to Arbitrary File Read to Account Takeover |
Critical EPSS 3.04% |
< 1.7.46 | 1.7.46 |
| GHSA-2m7x-c7px-hp58 Server Side Template Injection (SSTI) via Twig escape handler |
High EPSS 1.58% |
< 1.7.45 | 1.7.45 |
| GHSA-r6vw-8v8r-pmp4 Server Side Template Injection (SSTI) |
High EPSS 1.22% |
< 1.7.45 | 1.7.45 |
| GHSA-qfv4-q44r-g7rv Server Side Template Injection (SSTI) |
High EPSS 1.39% |
< 1.7.45 | 1.7.45 |
| GHSA-c9gp-64c4-2rrh Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass |
High EPSS 5.81% |
< 1.7.45 | 1.7.45 |
| GHSA-m7hx-hw6h-mqmc Grav File Upload Path Traversal |
High EPSS 60.59% |
< 1.7.45 | 1.7.45 |
| GHSA-f6g2-h7qv-3m5v Remote Code Execution by uploading a phar file using frontmatter |
High EPSS 1.36% |
< 1.7.43 | 1.7.43 |
| GHSA-xrf8-cmrg-7436 Cross-site scripting (XSS) vulnerability in Grav |
Medium EPSS 1.00% |
all versions | No fix yet |
| GHSA-9436-3gmp-4f53 grav Server-side Template Injection (SSTI) mitigation bypass |
High EPSS 2.81% |
< 1.7.42.2 | 1.7.42.2 |
| GHSA-whr7-m3f8-mpm8 Grav Server-side Template Injection (SSTI) via Twig Default Filters |
High EPSS 4.52% |
< 1.7.42 | 1.7.42 |
| GHSA-j3v8-v77f-fvgm Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability |
High EPSS 2.07% |
< 1.7.42 | 1.7.42 |
| GHSA-96xv-rmwj-6p9w Grav Server-side Template Injection (SSTI) via Twig Default Filters |
High EPSS 2.07% |
< 1.7.42 | 1.7.42 |
| GHSA-f9jf-4cp4-4fq5 Grav Server Side Template Injection (SSTI) vulnerability |
High EPSS 2.34% |
< 1.7.42 | 1.7.42 |
| GHSA-cxgw-r5jg-7xwq Code injection in grav |
High EPSS 10.91% |
< 1.7.34 | 1.7.34 |
| GHSA-gpmf-q5jh-hjx4 Grav CMS Arbitrary File Deletion |
High EPSS 2.90% |
>= 1.7.0-beta.1, <= 1.7.0-rc.17 | No fix yet |
| GHSA-r3rg-jrjq-w4mr Grav CMS Local File Injection |
Medium EPSS 0.98% |
< 1.6.30 | 1.6.30 |
| GHSA-r3rg-jrjq-w4mr Grav CMS Local File Injection |
Medium EPSS 0.98% |
>= 1.7.0-beta.1, <= 1.7.0-rc.17 | No fix yet |
| GHSA-fqff-vcvx-68h3 Grav CMS Cross-Site Request Forgery (CSRF) |
High EPSS 1.36% |
< 1.6.30 | 1.6.30 |
| GHSA-fqff-vcvx-68h3 Grav CMS Cross-Site Request Forgery (CSRF) |
High EPSS 1.36% |
>= 1.7.0-beta.1, <= 1.7.0-rc.17 | No fix yet |
| GHSA-gpmf-q5jh-hjx4 Grav CMS Arbitrary File Deletion |
High EPSS 2.90% |
< 1.6.30 | 1.6.30 |
| GHSA-977g-93f5-rqjx Grav CMS Cross-site scripting (XSS) vulnerability |
Medium EPSS 3.65% |
< 1.3.0 | 1.3.0 |
| GHSA-3p5m-j98p-c698 Stored cross site scripting in getgrav/grav |
Medium EPSS 1.54% |
< 1.7.33 | 1.7.33 |
| GHSA-r6hh-5g3q-wwgc Stored Cross-site Scripting in grav |
High EPSS 1.80% |
< 1.7.31 | 1.7.31 |
| GHSA-2p89-ppc2-mrq4 Cross site scripting in getgrav/grav |
Medium EPSS 1.36% |
< 1.7.31 | 1.7.31 |
| GHSA-735v-wx75-xmmm Cross-site Scripting in grav |
Medium EPSS 1.42% |
< 1.7.28 | 1.7.28 |
| GHSA-wrxc-mr2w-cjpv Open Redirect in Grav |
Medium EPSS 10.86% |
< 1.6.23 | 1.6.23 |
| GHSA-8c5p-4362-9333 Path traversal in grav |
High EPSS 4.36% |
<= 1.7.24 | No fix yet |
| GHSA-5jxc-hmqf-3f73 Cross-Site Scripting in grav |
Medium EPSS 0.59% |
< 1.7.24 | 1.7.24 |
| GHSA-cg3q-59w7-rvc2 Reliance on Cookies without Validation and Integrity Checking in getgrav/grav |
Medium EPSS 2.45% |
< 1.7.21 | 1.7.21 |
| GHSA-g8r4-p96j-xfxc Grav's Twig processing allowing dangerous PHP functions by default |
High EPSS 29.90% |
< 1.7.11 | 1.7.11 |
| GHSA-cvmr-6428-87w9 Cross-Site Scripting in Grav |
Medium EPSS 0.29% |
< 1.6.30 | 1.6.30 |
| GHSA-6268-v434-45m5 Cross-site Scripting in Grav |
Medium EPSS 1.54% |
< 1.7.0-beta.8 | 1.7.0-beta.8 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor