Technology · Grav
Grav vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 63 vulnerabilities in Grav: 0 in the last 7 days and 27 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116019, was published on 24 October 2026. 8 vulnerabilities in the last four weeks, up 167% on the four before (3).
- Last 7 days
- 0
- Last 90 days
- 27
- Critical, all time
- 6
- Exploited in the wild
- 0
About Grav
Grav is a flat-file content management system designed for building fast, flexible websites without a database.
Latest Grav vulnerabilities
- CVE-2026-116019: Grav allowlist bypass in Flex form processinghighCVSS 8.8
- CVE-2026-114660: Grav improper access control in FlexDirectory::dynamicFlexField()mediumCVSS 6.3
- CVE-2026-114657: Grav information disclosure via Twig HTTP Basic credentialsmediumCVSS 5.7
- CVE-2026-112782: Grav image pixel limit bypass allows resource exhaustionhighCVSS 7.5
- CVE-2026-109326: Grav information disclosure via nested Git repositorieshighCVSS 7.5EPSS 0.4%
- CVE-2026-109325: Grav Clockwork profiler authentication bypass in loopback checkhighCVSS 7.5EPSS 0.4%
- CVE-2026-109324: Grav memory exhaustion in image transformsmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109315: Grav information disclosure in Clockwork debugger token via Twig sandboxmediumCVSS 6.5EPSS 0.3%
- CVE-2026-100669: Grav case-insensitive path traversal bypass in access control ruleshighCVSS 7.5
- CVE-2026-92917: Grav Twig sandbox configuration disclosure via print_rhighCVSS 7.5EPSS 0.5%
- CVE-2026-92916: Grav CMS unauthenticated Clockwork profiler information disclosurehighCVSS 7.5EPSS 0.5%
- CVE-2025-64059: Grav stored cross-site scripting in Home Page editorlowCVSS 1.8EPSS 0.3%
- CVE-2026-85603: Grav admin plugin path traversal in Save As language parametermediumCVSS 6.5EPSS 0.6%
- Grav incomplete Twig sandbox denylist information disclosurehighCVSS 7.5
- Grav UserInterface offsetGet/offsetExists Twig sandbox bypassmediumCVSS 6.5
- Grav path traversal in MediaUploadTrait::deleteFilehighCVSS 8.1
- CVE-2026-76846: Grav sandbox config denial paths incomplete, exposing system secretshighCVSS 7.5EPSS 0.4%
- CVE-2026-76839: Grav User interface credential leak via Twig sandbox offsetGethighCVSS 7.7EPSS 0.5%
- CVE-2026-56709: Grav Host header injection in sendInvitationEmailhighCVSS 7.5EPSS 0.4%
- CVE-2026-64850: Grav remote code execution via unrestricted callable in Blueprint::dynamicData()highCVSS 4EPSS 0.5%
- Grav detectXss stored XSS bypass via unpaired quotehighCVSS 8.7
- Grav Blueprint dynamic-data arbitrary file write via error_loghighCVSS 8.8
- CVE-2026-75837: Grav missing admin.super guard in group blueprint access fieldcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-75834: Grav stored XSS via invalid UTF-8 byte in Security::detectXss()mediumCVSS 5.4EPSS 0.3%
- CVE-2026-75831: Grav stored XSS via Markdown audio/video source URLhighCVSS 7.6EPSS 0.4%
Most severe Grav vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-56700: Grav CMS multiple remote code execution vulnerabilitiescriticalCVSS 9.8EPSS 2.5%
- CVE-2026-65008: Grav remote code execution in Blueprint dynamicDatacriticalCVSS 9.8
- CVE-2026-42613: Grav Login plugin privilege escalation in registration handlercriticalCVSS 9.4EPSS 0.6%
- CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP uploadcriticalCVSS 9.1EPSS 2.3%
- CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlashcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-75837: Grav missing admin.super guard in group blueprint access fieldcriticalCVSS 9.1EPSS 0.5%
- CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin PluginhighCVSS 8.9EPSS 0.4%
- CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fieldshighCVSS 8.8EPSS 1.3%
- CVE-2026-75827: Grav Blueprint bare-function arbitrary file write via error_loghighCVSS 8.8EPSS 0.9%
- CVE-2026-42844: Grav privilege escalation via arbitrary file upload in blueprint-upload APIhighCVSS 8.8EPSS 0.5%
Vulnerabilities per week
8 vulnerabilities in the last four weeks, up 167% on the four before (3). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 8 | 1 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 1 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 2 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Grav vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/grav)<a href="https://junglewise.ai/threats/technologies/grav"><img src="https://junglewise.ai/threats/technologies/grav/badge.svg" alt="Grav vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/grav.json, and this page as text at https://junglewise.ai/threats/technologies/grav.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Grav vulnerabilities", https://junglewise.ai/threats/technologies/grav, 13 November 2026.