Technology · Packagist
getgrav/grav (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 127 vulnerabilities in getgrav/grav (Packagist): 0 in the last 7 days and 33 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86197, was published on 5 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 33
- Critical, all time
- 7
- Exploited in the wild
- 0
About getgrav/grav (Packagist)
PHP-based flat-file content management system.
Latest getgrav/grav (Packagist) vulnerabilities
- CVE-2026-86197: Grav cross-site scripting in Twig sandbox asset methodsmediumCVSS 4EPSS 0.4%
- CVE-2026-61842: Grav Twig sandbox config exfiltration via offsetGet and dump filtersmediumCVSS 6.5EPSS 0.4%
- CVE-2026-61690: Grav ZipArchiver decompression bomb via missing extraction limitsmediumCVSS 6.5EPSS 0.5%
- Grav UserInterface offsetGet/offsetExists Twig sandbox bypassmediumCVSS 6.5
- Grav incomplete Twig sandbox denylist information disclosurehighCVSS 7.5
- Grav CMS timing attack on nonce verification in CSRF protectionlowCVSS 3.7
- Grav path traversal in MediaUploadTrait::deleteFilehighCVSS 8.1
- Grav CMS Twig sandbox bypass in configuration variablesmediumCVSS 6.5
- Grav CMS origin validation bypass in referrer headermediumCVSS 5.4
- Grav CMS path traversal in media_directory() Twig functionmediumCVSS 6.5
- CVE-2026-76846: Grav sandbox config denial paths incomplete, exposing system secretshighCVSS 7.5EPSS 0.4%
- CVE-2026-76839: Grav User interface credential leak via Twig sandbox offsetGethighCVSS 7.7EPSS 0.5%
- CVE-2026-72702: Grav CMS origin validation bypass in referrer origin checkmediumCVSS 5.4EPSS 0.1%
- CVE-2026-72701: Grav CMS non-constant time nonce comparison in CSRF protectionlowCVSS 3.7EPSS 0.3%
- CVE-2026-72698: Grav CMS Twig sandbox bypass via system/site/theme arraysmediumCVSS 6.5EPSS 0.4%
- CVE-2026-72697: Grav CMS media_directory() path traversal and file disclosuremediumCVSS 6.5EPSS 0.5%
- CVE-2026-72695: Grav path traversal in MediaUploadTrait::deleteFile()highCVSS 8.1EPSS 0.9%
- CVE-2026-64850: Grav remote code execution via unrestricted callable in Blueprint::dynamicData()highCVSS 4EPSS 0.5%
- CVE-2026-62673: Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules…highCVSS 8.2EPSS 0.5%
- CVE-2026-62672: Grav authenticated ReDoS in regex_replace Twig filtermediumCVSS 6EPSS 0.4%
- CVE-2026-62669: Grav 2FA bypass via unauthorized secret regenerationhighCVSS 7.4EPSS 0.5%
- Grav stored XSS in audio/video media source URLhighCVSS 7.6
- Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator…lowCVSS 3.1
- Grav stored XSS bypass via invalid UTF-8 byte in detectXss()mediumCVSS 5.4
- Grav Blueprint dynamic-data arbitrary file write via error_loghighCVSS 8.8
Most severe getgrav/grav (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-56700: Grav CMS multiple remote code execution vulnerabilitiescriticalCVSS 9.8EPSS 2.5%
- CVE-2025-66301: Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actionscriticalCVSS 9.6EPSS 1.3%
- CVE-2026-42613: Grav Login plugin privilege escalation in registration handlercriticalCVSS 9.4EPSS 0.6%
- CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP uploadcriticalCVSS 9.1EPSS 2.3%
- CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlashcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-75837: Grav missing admin.super guard in group blueprint access fieldcriticalCVSS 9.1EPSS 0.5%
- CVE-2025-66844: Grav may be vulnerable to SSRF attack via Twig TemplatescriticalCVSS 9.1EPSS 0.3%
- CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin PluginhighCVSS 8.9EPSS 0.4%
- CVE-2025-66294: Grav is vulnerable to RCE via SSTI through Twig Sandbox BypasshighCVSS 8.8EPSS 2.8%
- CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fieldshighCVSS 8.8EPSS 1.3%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 16 | 1 | |
| 24 Aug 2026 | 14 | 0 | |
| 31 Aug 2026 | 3 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many getgrav/grav (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/getgrav-grav)<a href="https://junglewise.ai/threats/technologies/getgrav-grav"><img src="https://junglewise.ai/threats/technologies/getgrav-grav/badge.svg" alt="getgrav/grav (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/getgrav-grav.json, and this page as text at https://junglewise.ai/threats/technologies/getgrav-grav.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "getgrav/grav (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/getgrav-grav, 13 November 2026.