VendorsGetgravgrav2.0.0
Vulnerabilities

Getgrav Grav 2.0.0

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2026-42608
Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
Published 2026-05-11 · Analyzed
9.1EPSS 0.006
CVE-2026-42611
Grav: Stored XSS via Tag Injection
Published 2026-05-11 · Analyzed
8.9EPSS 0.004
CVE-2026-42844
Grav: Low-privileged API users can create super-admin accounts via blueprint-upload
Published 2026-05-12 · Analyzed
8.8EPSS 0.005
CVE-2026-42612
Grav: Publisher-Level Stored XSS via Unquoted Event Attributes
Published 2026-05-11 · Analyzed
8.5EPSS 0.003
CVE-2026-42609
Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Published 2026-05-11 · Modified
8.1EPSS 0.006
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Published 2026-05-11 · Modified
7.7EPSS 0.004
CVE-2026-59193
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
Published 2026-07-10 · Modified
6.9EPSS 0.006
CVE-2026-42841
Grav: Stored XSS via Markdown media attribute() action in Grav CMS
Published 2026-05-11 · Analyzed
6.9EPSS 0.003
CVE-2026-42610
Grav: Sensitive Information Disclosure via Accounts Service Bypass
Published 2026-05-11 · Analyzed
6.5EPSS 0.004