getgrav records

74 published records for vendor getgrav.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 4 · 5.4%
Pre-auth RCE: 7
With a fix record: 79.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

74 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
63This week	CVE-2021-21425Weaponized	Unauthenticated Arbitrary YAML Write/Update leads to Code Executiongetgrav · grav-plugin-admin · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	80.6%	Apr 7, 2021
60This week	CVE-2025-50286Weaponized	A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/togetgrav · grav · CWE-434 pre-auth RCE File upload	High8.1	—	14.6%	Aug 6, 2025
53Plan	CVE-2024-27921No exploit	Grav File Upload Path Traversal vulnerabilitygetgrav · grav · CWE-22 RCE Path traversal	High8.8	—	60.5%	Mar 21, 2024
40Plan	CVE-2024-34082No exploit	Grav Arbitrary File Read to Account Takeovergetgrav · grav · CWE-269	Critical9.9	—	3.0%	May 15, 2024
40Plan	CVE-2025-66294Weaponized	Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypassgetgrav · grav · CWE-94 RCE SSTI	High8.7	—	2.8%	Dec 1, 2025
40Plan	CVE-2025-66301Weaponized	Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionsgetgrav · grav · CWE-285 Broken access control (IDOR)	High8.6	—	1.3%	Dec 1, 2025
39Monitor	CVE-2025-46199No exploit	Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the formgetgrav · grav · CWE-79 pre-auth RCE XSS	Critical9.8	—	0.9%	Jul 25, 2025
38Monitor	CVE-2021-47812No exploit	GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)getgrav · grav · CWE-862 pre-auth RCE Broken access control (IDOR)	Critical9.3	—	2.2%	Jan 15, 2026
37Monitor	CVE-2021-29440Proof of concept	Twig allowing dangerous PHP functions by defaultgetgrav · grav · CWE-94 RCE	High7.2	—	29.8%	Apr 13, 2021
37Monitor	CVE-2024-28116Proof of concept	Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypassgetgrav · grav · CWE-94 RCE SSTI	High8.8	—	5.8%	Mar 21, 2024
36Monitor	CVE-2023-37897No exploit	Server-side Template Injection (SSTI) in gravgetgrav · grav · CWE-74 SSTI	High8.8	—	2.8%	Jul 18, 2023
36Monitor	CVE-2025-66844No exploit	In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig angetgrav · grav · CWE-918 Pre-auth SSRF	Critical9.1	—	0.2%	Dec 15, 2025
35Monitor	CVE-2024-28119No exploit	Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlergetgrav · grav · CWE-94 RCE SSTI	High8.8	—	1.5%	Mar 21, 2024
35Monitor	CVE-2024-28117No exploit	Grav vulnerable to Server Side Template Injection (SSTI)getgrav · grav · CWE-94 RCE SSTI	High8.8	—	1.3%	Mar 21, 2024
35Monitor	CVE-2020-29553No exploit	The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious getgrav · grav cms · CWE-352 Pre-auth CSRF	High8.8	—	1.3%	Mar 15, 2021
35Monitor	CVE-2024-27923No exploit	Remote Code Execution by uploading a phar file using frontmattergetgrav · grav · CWE-287 RCE Auth bypass	High8.8	—	1.3%	Mar 20, 2024
35Monitor	CVE-2024-28118No exploit	Grav vulnerable to Server Side Template Injection (SSTI)getgrav · grav · CWE-94 RCE SSTI	High8.8	—	1.2%	Mar 21, 2024
35Monitor	CVE-2025-46198No exploit	Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attrgetgrav · grav · CWE-79 pre-auth RCE XSS	High8.8	—	0.7%	Jul 25, 2025
35Monitor	CVE-2025-66299No exploit	Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMSgetgrav · grav · CWE-94 RCE SSTI	High8.8	—	0.6%	Dec 1, 2025
35Monitor	CVE-2026-42608No exploit	Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.getgrav · grav · CWE-22 Pre-auth Path traversal	High8.8	—	0.6%	May 11, 2026
35Monitor	CVE-2025-66295No exploit	Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruptiongetgrav · grav · CWE-22 Path traversal	High8.8	—	0.5%	Dec 1, 2025
35Monitor	CVE-2026-42843No exploit	grav-plugin-api: Grav API Privilege Escalation to Super Admingetgrav · grav-plugin-api · CWE-863 RCE Broken access control (IDOR)	High8.8	—	0.3%	May 11, 2026
35Monitor	CVE-2025-66296No exploit	Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeovergetgrav · grav · CWE-266	High8.8	—	0.3%	Dec 1, 2025
35Monitor	CVE-2026-42611No exploit	Grav: Stored XSS via Tag Injectiongetgrav · grav · CWE-79 RCE XSS	High8.9	—	0.3%	May 11, 2026
34Monitor	CVE-2025-66300No exploit	Grav is vulnerable to Arbitrary File Readgetgrav · grav · CWE-22 Path traversal	High8.5	—	0.4%	Dec 1, 2025

CVE-2021-21425
63This week
Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
CriticalCVSS 9.8WeaponizedEPSS 80%
- Pre-auth
- Broken access control (IDOR)
getgrav · grav-plugin-adminApr 7, 2021
CVE-2025-50286
60This week
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/to
HighCVSS 8.1WeaponizedEPSS 14%
- pre-auth RCE
- File upload
getgrav · gravAug 6, 2025
CVE-2024-27921
53Plan
Grav File Upload Path Traversal vulnerability
HighCVSS 8.8No exploitEPSS 60%
- RCE
- Path traversal
getgrav · gravMar 21, 2024
CVE-2024-34082
40Plan
Grav Arbitrary File Read to Account Takeover
CriticalCVSS 9.9No exploitEPSS 3%
getgrav · gravMay 15, 2024
CVE-2025-66294
40Plan
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
HighCVSS 8.7WeaponizedEPSS 2%
- RCE
- SSTI
getgrav · gravDec 1, 2025
CVE-2025-66301
40Plan
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
HighCVSS 8.6WeaponizedEPSS 1%
- Broken access control (IDOR)
getgrav · gravDec 1, 2025
CVE-2025-46199
39Monitor
Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- XSS
getgrav · gravJul 25, 2025
CVE-2021-47812
38Monitor
GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Broken access control (IDOR)
getgrav · gravJan 15, 2026
CVE-2021-29440
37Monitor
Twig allowing dangerous PHP functions by default
HighCVSS 7.2Proof of conceptEPSS 29%
- RCE
getgrav · gravApr 13, 2021
CVE-2024-28116
37Monitor
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
HighCVSS 8.8Proof of conceptEPSS 5%
- RCE
- SSTI
getgrav · gravMar 21, 2024
CVE-2023-37897
36Monitor
Server-side Template Injection (SSTI) in grav
HighCVSS 8.8No exploitEPSS 2%
- SSTI
getgrav · gravJul 18, 2023
CVE-2025-66844
36Monitor
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig an
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
getgrav · gravDec 15, 2025
CVE-2024-28119
35Monitor
Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SSTI
getgrav · gravMar 21, 2024
CVE-2024-28117
35Monitor
Grav vulnerable to Server Side Template Injection (SSTI)
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SSTI
getgrav · gravMar 21, 2024
CVE-2020-29553
35Monitor
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- CSRF
getgrav · grav cmsMar 15, 2021
CVE-2024-27923
35Monitor
Remote Code Execution by uploading a phar file using frontmatter
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Auth bypass
getgrav · gravMar 20, 2024
CVE-2024-28118
35Monitor
Grav vulnerable to Server Side Template Injection (SSTI)
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SSTI
getgrav · gravMar 21, 2024
CVE-2025-46198
35Monitor
Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- XSS
getgrav · gravJul 25, 2025
CVE-2025-66299
35Monitor
Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SSTI
getgrav · gravDec 1, 2025
CVE-2026-42608
35Monitor
Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
getgrav · gravMay 11, 2026
CVE-2025-66295
35Monitor
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HighCVSS 8.8No exploitEPSS 0%
- Path traversal
getgrav · gravDec 1, 2025
CVE-2026-42843
35Monitor
grav-plugin-api: Grav API Privilege Escalation to Super Admin
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
getgrav · grav-plugin-apiMay 11, 2026
CVE-2025-66296
35Monitor
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
HighCVSS 8.8No exploitEPSS 0%
getgrav · gravDec 1, 2025
CVE-2026-42611
35Monitor
Grav: Stored XSS via Tag Injection
HighCVSS 8.9No exploitEPSS 0%
- RCE
- XSS
getgrav · gravMay 11, 2026
CVE-2025-66300
34Monitor
Grav is vulnerable to Arbitrary File Read
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
getgrav · gravDec 1, 2025