# Getgrav vulnerabilities Source: https://junglewise.ai/threats/vendors/getgrav Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/getgrav.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 49 vulnerabilities in Getgrav: 1 in the last 7 days and 20 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124434, was published on 8 November 2026. 10 vulnerabilities in the last four weeks, up 150% on the four before (4). 4 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 4 - Last 90 days: 20 - All time: 49 (4 critical, 0 exploited in the wild) ## About Getgrav GetGrav is the organization responsible for the development of the Grav flat-file content management system. ## Latest Getgrav vulnerabilities - [CVE-2026-124434: Grav Lightbox Gallery plugin arbitrary method invocation in shortcode](https://junglewise.ai/threats/cve-2026-124434-grav-lightbox-gallery-plugin-1-1-0-before-1-3-2-on-grav-2-x) (high, CVSS 7.1, published 8 Nov 2026) - [CVE-2026-117604: Grav authorization bypass in Clockwork profiler debugger](https://junglewise.ai/threats/cve-2026-117604-grav-from-1-7-53-3-before-1-7-53-6-contains-an-authorization) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-112781: Grav information disclosure via form config directives](https://junglewise.ai/threats/cve-2026-112781-grav-from-2-0-0-before-2-2-2-contains-an-information-disclosure) (medium, CVSS 6.5, published 19 Oct 2026) - [CVE-2026-112780: Grav allowlist bypass in Flex form field renaming](https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-109323: Grav Star Ratings missing server-side authorization in vote handler](https://junglewise.ai/threats/cve-2026-109323-grav-star-ratings-2-0-1-through-2-0-3-contains-a-missing) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109318: Grav Git Sync command injection via commit author](https://junglewise.ai/threats/cve-2026-109318-grav-git-sync-1-0-2-through-3-4-12-contains-a-command-injection) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109317: Grav grav-plugin-api privilege escalation in access grant validation](https://junglewise.ai/threats/cve-2026-109317-grav-grav-plugin-api-before-1-0-36-contains-a-privilege) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-109314: Grav Login plugin information disclosure in password-reset page](https://junglewise.ai/threats/cve-2026-109314-grav-login-plugin-1-2-0-before-3-9-9-contains-an-information) (high, CVSS 7.3, published 12 Oct 2026) - [CVE-2026-109313: Grav Login plugin authentication bypass in two-factor authentication](https://junglewise.ai/threats/cve-2026-109313-grav-login-plugin-2-7-0-before-3-9-9-contains-an-authentication) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-109312: Grav Login plugin authentication bypass in 2FA profile update](https://junglewise.ai/threats/cve-2026-109312-grav-login-plugin-2-7-0-before-3-9-9-contains-an-authentication) (high, CVSS 8.1, published 12 Oct 2026) - [CVE-2026-100673: Grav Data Manager stored XSS in item-detail view](https://junglewise.ai/threats/cve-2026-100673-the-grav-data-manager-plugin-getgrav-grav-plugin-datamanager) (high, CVSS 8.2, published 26 Sep 2026) - [CVE-2026-100671: Grav session cookie theft via Twig sandbox](https://junglewise.ai/threats/cve-2026-100671-grav-is-a-flat-file-cms-in-versions-2-0-19-through-2-0-24-and-in) (high, CVSS 8, published 26 Sep 2026) - [CVE-2026-100668: Grav sandbox escape via array filter](https://junglewise.ai/threats/cve-2026-100668-grav-2-0-0-through-2-0-24-contain-a-twig-content-sandbox-escape) (medium, CVSS 6.5, published 26 Sep 2026) - [CVE-2026-100667: Grav Login plugin two-factor authentication bypass](https://junglewise.ai/threats/cve-2026-100667-grav-plugin-login-the-grav-cms-login-plugin-versions-3-8-7-and-3) (medium, CVSS 5.3, published 26 Sep 2026) - [CVE-2026-86197: Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods) (medium, CVSS 4, published 5 Sep 2026) - [CVE-2026-86195: Getgrav grav-plugin-api privilege escalation via dot-keyed super flag](https://junglewise.ai/threats/cve-2026-86195-getgrav-grav-plugin-api-privilege-escalation-via-dot-keyed-super) (info, CVSS 8.7, published 5 Sep 2026) - [CVE-2026-72697: Grav CMS media_directory() path traversal and file disclosure](https://junglewise.ai/threats/cve-2026-72697-grav-cms-media-directory-path-traversal-and-file-disclosure) (medium, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-62670: Grav Flex Objects Plugin authorization bypass in admin-next API](https://junglewise.ai/threats/cve-2026-62670-grav-flex-objects-plugin-authorization-bypass-in-admin-next-api) (medium, CVSS 6.3, published 19 Aug 2026) - [CVE-2026-75835: Grav API plugin missing authorization in scope validation](https://junglewise.ai/threats/cve-2026-75835-grav-api-plugin-missing-authorization-in-scope-validation) (medium, CVSS 4.3, published 18 Aug 2026) - [CVE-2026-75828: Grav stored XSS in XSS detector via unpaired quote bypass](https://junglewise.ai/threats/cve-2026-75828-grav-stored-xss-in-xss-detector-via-unpaired-quote-bypass) (high, CVSS 8.7, published 18 Aug 2026) - [CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fields](https://junglewise.ai/threats/cve-2026-65608-grav-remote-code-execution-in-flexdirectory-dynamic-data-fields) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-65007: Grav api plugin missing authorization in API key generation](https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-62237: Grav ReDoS in Twig sandbox regex_replace filter](https://junglewise.ai/threats/cve-2026-62237-grav-redos-in-twig-sandbox-regex-replace-filter) (medium, CVSS 6.5, published 17 Jul 2026) - [CVE-2026-62233: getgrav grav-plugin-api privilege escalation in user management endpoints](https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management) (high, CVSS 8.8, published 17 Jul 2026) - [CVE-2026-62232: Grav Login plugin two-factor authentication bypass in regenerate2FASecret](https://junglewise.ai/threats/cve-2026-62232-grav-login-plugin-two-factor-authentication-bypass-in) (high, CVSS 7.4, published 17 Jul 2026) ## Most severe Getgrav vulnerabilities - [CVE-2026-65007: Grav api plugin missing authorization in API key generation](https://junglewise.ai/threats/cve-2026-65007-grav-api-plugin-missing-authorization-in-api-key-generation) (critical, CVSS 9.6, published 21 Jul 2026) - [CVE-2026-42607: Grav Remote Code Execution via Direct Install ZIP upload](https://junglewise.ai/threats/cve-2026-42607-grav-remote-code-execution-via-direct-install-zip-upload) (critical, CVSS 9.1, published 11 May 2026) - [CVE-2026-42608: Grav Path Traversal and Arbitrary File Write in FormFlash](https://junglewise.ai/threats/cve-2026-42608-grav-path-traversal-and-arbitrary-file-write-in-formflash) (critical, CVSS 9.1, published 11 May 2026) - [CVE-2025-66844: Grav may be vulnerable to SSRF attack via Twig Templates](https://junglewise.ai/threats/cve-2025-66844-grav-may-be-vulnerable-to-ssrf-attack-via-twig-templates) (critical, CVSS 9.1, published 15 Dec 2025) - [CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin Plugin](https://junglewise.ai/threats/cve-2026-42611-grav-stored-xss-via-svg-tag-injection-in-admin-plugin) (high, CVSS 8.9, published 11 May 2026) - [CVE-2026-65608: Grav remote code execution in FlexDirectory dynamic data fields](https://junglewise.ai/threats/cve-2026-65608-grav-remote-code-execution-in-flexdirectory-dynamic-data-fields) (high, CVSS 8.8, published 23 Jul 2026) - [CVE-2026-109318: Grav Git Sync command injection via commit author](https://junglewise.ai/threats/cve-2026-109318-grav-git-sync-1-0-2-through-3-4-12-contains-a-command-injection) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-42844: Grav privilege escalation via arbitrary file upload in blueprint-upload API](https://junglewise.ai/threats/cve-2026-42844-grav-privilege-escalation-via-arbitrary-file-upload-in-blueprint) (high, CVSS 8.8, published 12 May 2026) - [CVE-2026-112780: Grav allowlist bypass in Flex form field renaming](https://junglewise.ai/threats/cve-2026-112780-grav-from-2-0-15-before-2-2-2-contains-an-allowlist-bypass) (high, CVSS 8.8, published 19 Oct 2026) - [CVE-2026-62233: getgrav grav-plugin-api privilege escalation in user management endpoints](https://junglewise.ai/threats/cve-2026-62233-getgrav-grav-plugin-api-privilege-escalation-in-user-management) (high, CVSS 8.8, published 17 Jul 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 150% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 4 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 6 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Getgrav technologies - [Getgrav Grav](https://junglewise.ai/threats/technologies/getgrav-grav-1): 31 vulnerabilities - [Getgrav Grav-Plugin-Api](https://junglewise.ai/threats/technologies/grav-plugin-api): 6 vulnerabilities - [Getgrav Login Plugin](https://junglewise.ai/threats/technologies/getgrav-login-plugin): 3 vulnerabilities - [Getgrav Grav-Plugin-Admin](https://junglewise.ai/threats/technologies/grav-plugin-admin): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Getgrav vulnerabilities", https://junglewise.ai/threats/vendors/getgrav, 12 November 2026.