Product by Getgrav

    Getgrav/grav

    83 known vulnerabilities in Getgrav/grav (Getgrav), 0 of them actively exploited (CISA KEV).

    Key figures

    83

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Getgrav/grav (Getgrav)
    CriticalCVE-2026-42607

    Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

    also in 1 other product

    		9.1
    CriticalCVE-2026-65008

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    also in 1 other product

    		9.8
    HighCVE-2024-27921

    Grav File Upload Path Traversal vulnerability

    also in 1 other product

    		8.8
    HighCVE-2026-61450

    Grav before 2.0.2 Config Exfiltration via offsetGet Filter

    also in 1 other product

    		6.5
    CriticalCVE-2022-2073

    Code Injection in getgrav/grav

    also in 1 other product

    		9.1
    HighCVE-2021-29440

    Twig allowing dangerous PHP functions by default

    also in 1 other product

    		8.4
    HighCVE-2024-28116

    Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

    also in 1 other product

    		8.8
    HighCVE-2023-34448

    Grav Server-side Template Injection (SSTI) via Twig Default Filters

    also in 1 other product

    		8.8
    HighCVE-2021-3924

    Path Traversal in getgrav/grav

    also in 1 other product

    		8.8
    CriticalCVE-2024-34082

    Grav Arbitrary File Read to Account Takeover

    also in 1 other product

    		8.5
    CriticalCVE-2023-34251

    Grav Server Side Template Injection vulnerability

    also in 1 other product

    		10.0
    MediumCVE-2020-11529

    Grav: Open Redirect

    also in 1 other product

    		6.1
    HighCVE-2020-29555

    getgrav Grav CMS: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		8.1
    HighCVE-2026-65608

    Grav before 2.0.9 Remote Code Execution via FlexDirectory

    also in 1 other product

    		8.8
    HighCVE-2023-34253

    Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

    also in 1 other product

    		8.8
    HighCVE-2023-34252

    Grav Server-side Template Injection via Insufficient Validation in filterFilter

    also in 1 other product

    		8.8
    CriticalCVE-2026-42613

    Grav: Privilege Escalation via Missing Server-Side Validation of groups/access

    also in 1 other product

    		9.4
    HighCVE-2023-37897

    Server-side Template Injection (SSTI) in grav

    also in 1 other product

    		7.2
    CriticalCVE-2026-75827

    Grav before 2.0.15 Arbitrary File Write via error_log

    also in 1 other product

    		8.8
    HighCVE-2026-72819

    Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

    also in 1 other product

    		8.8
    MediumCVE-2018-5233

    getgrav Grav CMS: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2024-28119

    Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler

    also in 1 other product

    		8.8
    HighCVE-2024-28117

    Grav vulnerable to Server Side Template Injection (SSTI)

    also in 1 other product

    		8.8
    HighCVE-2024-27923

    Remote Code Execution by uploading a phar file using frontmatter

    also in 1 other product

    		8.8
    MediumCVE-2021-3818

    Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

    also in 1 other product

    		6.3

    All vulnerabilities in search

    News

    All products by Getgrav