# Getgrav Grav vulnerabilities Source: https://junglewise.ai/threats/technologies/getgrav-grav-1 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/getgrav-grav-1.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in Getgrav Grav: 0 in the last 7 days and 8 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-117604, was published on 27 October 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 8 - All time: 31 (3 critical, 0 exploited in the wild) ## About Getgrav Grav Flat-file content management system written in PHP with Git synchronization support. ## Latest Getgrav Grav vulnerabilities - [CVE-2026-117604: Grav authorization bypass in Clockwork profiler debugger](https://junglewise.ai/threats/cve-2026-117604-grav-from-1-7-53-3-before-1-7-53-6-contains-an-authorization) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-112781: Grav information disclosure via form config directives](https://junglewise.ai/threats/cve-2026-112781-grav-from-2-0-0-before-2-2-2-contains-an-information-disclosure) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-112780: Grav allowlist bypass in Flex form field renaming](https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-100671: Grav session cookie theft via Twig sandbox](https://junglewise.ai/threats/cve-2026-100671-grav-is-a-flat-file-cms-in-versions-2-0-19-through-2-0-24-and-in) (high, CVSS 8, published 26 Sep 2026) - [CVE-2026-100668: Grav sandbox escape via array filter](https://junglewise.ai/threats/cve-2026-100668-grav-2-0-0-through-2-0-24-contain-a-twig-content-sandbox-escape) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-86197: Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods) (medium, CVSS 4, published 5 Sep 2026) - [CVE-2026-72697: Grav CMS media_directory() path traversal and file disclosure](https://junglewise.ai/threats/cve-2026-72697-grav-cms-media-directory-path-traversal-and-file-disclosure) (medium, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-75828: Grav stored XSS in XSS detector via unpaired quote bypass](https://junglewise.ai/threats/cve-2026-75828-grav-stored-xss-in-xss-detector-via-unpaired-quote-bypass) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fields](https://junglewise.ai/threats/cve-2026-65608-grav-remote-code-execution-in-flexdirectory-dynamic-data-fields) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-62237: Grav ReDoS in Twig sandbox regex_replace filter](https://junglewise.ai/threats/cve-2026-62237-grav-redos-in-twig-sandbox-regex-replace-filter) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-62232: Grav Login plugin two-factor authentication bypass in regenerate2FASecret](https://junglewise.ai/threats/cve-2026-62232-grav-login-plugin-two-factor-authentication-bypass-in) (high, CVSS 7.4, published 17 Jul 2026) - [CVE-2026-62230: Grav .htaccess security bypass via case variation](https://junglewise.ai/threats/cve-2026-62230-grav-htaccess-security-bypass-via-case-variation) (high, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-61449: Grav decompression bomb size-cap bypass in ZipArchiver](https://junglewise.ai/threats/cve-2026-61449-grav-decompression-bomb-size-cap-bypass-in-ziparchiver) (medium, CVSS 6.5, published 15 Jul 2026) - [CVE-2026-55890: Grav stored CSS injection in Markdown image style attribute](https://junglewise.ai/threats/cve-2026-55890-grav-stored-css-injection-in-markdown-image-style-attribute) (medium, CVSS 4.8, published 10 Jul 2026) - [CVE-2026-55885: Grav sensitive data exposure in Admin backup component](https://junglewise.ai/threats/cve-2026-55885-grav-sensitive-data-exposure-in-admin-backup-component) (medium, CVSS 6.8, published 10 Jul 2026) - [CVE-2026-53653: Grav denial of service via unbounded image resizing](https://junglewise.ai/threats/cve-2026-53653-grav-denial-of-service-via-unbounded-image-resizing) (high, CVSS 4, published 10 Jul 2026) - [CVE-2026-61455: Grav decompression bomb in ZipArchiver](https://junglewise.ai/threats/cve-2026-61455-grav-decompression-bomb-in-ziparchiver) (medium, CVSS 6.5, published 10 Jul 2026) - [CVE-2026-61450: Grav Twig sandbox bypass in grav.offsetGet method](https://junglewise.ai/threats/cve-2026-61450-grav-twig-sandbox-bypass-in-grav-offsetget-method) (medium, CVSS 6.5, published 10 Jul 2026) - [CVE-2026-58657: Grav stored CSS injection in Markdown image resize action](https://junglewise.ai/threats/cve-2026-58657-grav-stored-css-injection-in-markdown-image-resize-action) (medium, CVSS 4.8, published 8 Jul 2026) - [CVE-2026-42844: Grav privilege escalation via arbitrary file upload in blueprint-upload API](https://junglewise.ai/threats/cve-2026-42844-grav-privilege-escalation-via-arbitrary-file-upload-in-blueprint) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-44738: Grav information disclosure via Twig sandbox allow-list](https://junglewise.ai/threats/cve-2026-44738-grav-information-disclosure-via-twig-sandbox-allow-list) (high, CVSS 7.7, published 11 May 2026) - [CVE-2026-44737: Grav Admin Plugin stored XSS in page move dialog](https://junglewise.ai/threats/cve-2026-44737-grav-admin-plugin-stored-xss-in-page-move-dialog) (medium, CVSS 4, published 11 May 2026) - [CVE-2026-42841: getgrav Grav stored XSS via Markdown media attribute action](https://junglewise.ai/threats/cve-2026-42841-grav-stored-xss-via-markdown-media-attribute-action) (medium, CVSS 4.8, published 11 May 2026) - [CVE-2026-42612: getgrav Grav stored XSS in detectXss function](https://junglewise.ai/threats/cve-2026-42612-getgrav-grav-stored-xss-in-detectxss-function) (high, CVSS 8.5, published 11 May 2026) - [CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin Plugin](https://junglewise.ai/threats/cve-2026-42611-grav-stored-xss-via-svg-tag-injection-in-admin-plugin) (high, CVSS 8.9, published 11 May 2026) ## Most severe Getgrav Grav vulnerabilities - [CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP upload](https://junglewise.ai/threats/cve-2026-42607-grav-remote-code-execution-via-direct-install-zip-upload) (critical, CVSS 9.1, published 11 May 2026) - [CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlash](https://junglewise.ai/threats/cve-2026-42608-grav-path-traversal-and-arbitrary-file-write-in-formflash) (critical, CVSS 9.1, published 11 May 2026) - [CVE-2025-66844: Grav may be vulnerable to SSRF attack via Twig Templates](https://junglewise.ai/threats/cve-2025-66844-grav-may-be-vulnerable-to-ssrf-attack-via-twig-templates) (critical, CVSS 9.1, published 15 Dec 2025) - [CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin Plugin](https://junglewise.ai/threats/cve-2026-42611-grav-stored-xss-via-svg-tag-injection-in-admin-plugin) (high, CVSS 8.9, published 11 May 2026) - [CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fields](https://junglewise.ai/threats/cve-2026-65608-grav-remote-code-execution-in-flexdirectory-dynamic-data-fields) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-42844: Grav privilege escalation via arbitrary file upload in blueprint-upload API](https://junglewise.ai/threats/cve-2026-42844-grav-privilege-escalation-via-arbitrary-file-upload-in-blueprint) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-112780: Grav allowlist bypass in Flex form field renaming](https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-75828: Grav stored XSS in XSS detector via unpaired quote bypass](https://junglewise.ai/threats/cve-2026-75828-grav-stored-xss-in-xss-detector-via-unpaired-quote-bypass) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-42612: getgrav Grav stored XSS in detectXss function](https://junglewise.ai/threats/cve-2026-42612-getgrav-grav-stored-xss-in-detectxss-function) (high, CVSS 8.5, published 11 May 2026) - [CVE-2026-42609: Grav Admin Panel account overwrite via business logic flaw](https://junglewise.ai/threats/cve-2026-42609-grav-admin-panel-account-overwrite-via-business-logic-flaw) (high, CVSS 8.1, published 11 May 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Getgrav technologies - [Getgrav Grav-Plugin-Api](https://junglewise.ai/threats/technologies/grav-plugin-api): 6 vulnerabilities - [Getgrav Login Plugin](https://junglewise.ai/threats/technologies/getgrav-login-plugin): 3 vulnerabilities - [Getgrav Grav-Plugin-Admin](https://junglewise.ai/threats/technologies/grav-plugin-admin): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Getgrav Grav vulnerabilities", https://junglewise.ai/threats/technologies/getgrav-grav-1, 9 November 2026.