getgrav/grav Known Vulnerabilities & Fixes
getgrav/grav has 21 known security vulnerabilities in Packagist (PHP). Upgrade to version 2.0.16 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 2.0.16
Upgrading to 2.0.16 or later resolves all 21 known vulnerabilities in getgrav/grav. Run: composer require getgrav/grav:^2.0.16
Is getgrav/grav in your project?
Check if you're affected and upgrade to 2.0.16 to stay secure.
Security Summary
- 21 affected version ranges have been identified across these 21 advisories.
- 95% of known issues have a published fixed version.
- Remediation: composer update getgrav/grav
Vulnerabilities
21 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Dec 2, 2025, most recently Sep 17, 2026 (290 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2026-42613 Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access | CRITICAL | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+317 more) | 2.0.0-beta.2 |
| CVE-2026-42607 Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature | CRITICAL | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+317 more) | 2.0.0-beta.2 |
| CVE-2026-75827 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write | CRITICAL | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+345 more) | 2.0.15 |
| CVE-2025-66844 Grav may be vulnerable to SSRF attack via Twig Templates | CRITICAL | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+281 more) | No fix available |
| CVE-2026-75828 Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS | CRITICAL | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+345 more) | 2.0.15 |
| CVE-2025-66300 Grav is vulnerable to Arbitrary File Read | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2026-72695 Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+346 more) | 2.0.16 |
| CVE-2026-69088 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure | HIGH | 2.0.10, 2.0.7, 2.0.8, 2.0.9 | 2.0.11 |
| CVE-2026-75837 Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+344 more) | 2.0.14 |
| CVE-2026-42608 Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+317 more) | 2.0.0-beta.2 |
| CVE-2026-72819 Grav CMS vulnerable to remote code execution via .zip file upload | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+343 more) | 2.0.13 |
| CVE-2026-65608 Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation | HIGH | 1.7.0, 1.7.1, 1.7.10, 1.7.12 (+120 more) | 2.0.9 |
| CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+337 more) | 2.0.7 |
| CVE-2026-42611 Grav is Vulnerable to Stored XSS via Tag Injection | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+317 more) | 2.0.0-beta.2 |
| CVE-2026-42844 Low-privileged Grav API users can create super-admin accounts via blueprint-upload | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+319 more) | 2.0.0-beta.4 |
| CVE-2025-66294 Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2025-66297 Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2025-66295 Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2025-66299 Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection) | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2025-66296 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+313 more) | 1.8.0-beta.27 |
| CVE-2026-42612 Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes | HIGH | 0.8.0, 0.9.0, 0.9.1, 0.9.10 (+317 more) | 2.0.0-beta.2 |
About This Data
Vulnerability data for getgrav/grav is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related Packagist (PHP) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of getgrav/grav.