Product by Getgrav

    Grav

    181 known vulnerabilities in Grav (Getgrav), 0 of them actively exploited (CISA KEV).

    Key figures

    181

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    26

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Grav (Getgrav)
    CriticalCVE-2026-42607

    Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

    		9.1
    CriticalCVE-2026-65008

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    		9.8
    HighCVE-2024-27921

    Grav File Upload Path Traversal vulnerability

    		8.8
    HighCVE-2025-50286

    Grav: Remote Code Execution

    		8.1
    HighCVE-2026-61450

    Grav before 2.0.2 Config Exfiltration via offsetGet Filter

    		6.5
    CriticalCVE-2022-2073

    Code Injection in getgrav/grav

    also in 1 other product

    		9.1
    HighCVE-2021-29440

    Twig allowing dangerous PHP functions by default

    		8.4
    HighCVE-2024-28116

    Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

    		8.8
    CriticalCVE-2021-47812

    GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

    		9.8
    HighCVE-2025-66294

    Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

    		8.8
    HighCVE-2023-34448

    Grav Server-side Template Injection (SSTI) via Twig Default Filters

    		8.8
    HighCVE-2021-3924

    Path Traversal in getgrav/grav

    also in 1 other product

    		8.8
    CriticalCVE-2024-34082

    Grav Arbitrary File Read to Account Takeover

    		8.5
    CriticalCVE-2023-34251

    Grav Server Side Template Injection vulnerability

    		10.0
    HighCVE-2026-58655

    Grav Flex Objects - Server-Side Template Injection via Dynamic Titles

    		8.8
    MediumCVE-2020-11529

    Grav: Open Redirect

    		6.1
    CriticalCVE-2025-66301

    Grav: Improper Authorization

    		9.6
    HighCVE-2026-65608

    Grav before 2.0.9 Remote Code Execution via FlexDirectory

    		8.8
    HighCVE-2023-34253

    Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

    		8.8
    HighCVE-2023-34252

    Grav Server-side Template Injection via Insufficient Validation in filterFilter

    		8.8
    CriticalCVE-2026-112780

    Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@

    		8.8
    HighCVE-2023-37897

    Server-side Template Injection (SSTI) in grav

    		7.2
    HighCVE-2026-112782

    Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

    		7.5
    CriticalCVE-2026-75827

    Grav before 2.0.15 Arbitrary File Write via error_log

    		8.8
    HighCVE-2026-85604

    Grav before 2.0.18 Remote Code Execution via sort filter

    		8.8

    All vulnerabilities in search

    News

    All products by Getgrav