Grav vulnerabilities

Grav v2.0.0 contains a cross-site scripting vulnerability, fixed in 2.0.1. The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. An attacker can supply a crafted ZIP archive with forged small entry sizes that bypass the limit, while extraction writes the actual much larger content, leading to disk or inode exhaustion.

A vulnerability in Grav prior to version 2.0.0 allows an authenticated admin.super user to crash the system or fill the disk by uploading a specially crafted ZIP archive via the Direct Install tool. The issue stems from the unZip function lacking limits on uncompressed size, entry count, or directory depth.

Grav prior to 2.0.0-rc.9 contains a stored XSS vulnerability via the Markdown image style attribute. The incomplete fix for CVE-2026-42841 leaves the MediaObjectTrait::style method reachable through the same excerpt-action pipeline, allowing an editor to save unsanitized image style parameters.

A vulnerability in Grav allows an authenticated administrator with backup permissions to download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration. The issue is fixed in version 1.7.53.

Grav, a file-based web platform, contains a vulnerability allowing an unauthenticated attacker to exhaust server memory and CPU by requesting oversized image derivatives. The issue is in the `Grav::fallbackUrl` mechanism, which passes request parameters to ImageMedium magic actions without dimension or pixel limits.

Grav before version 2.0.1 contains a decompression bomb vulnerability in the ZipArchiver::extract() method, which lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

Grav before version 2.0.0 (up to 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpts::processMediaActions() writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor who can edit page Markdown can store a crafted image URL with semicolon-delimited CSS declarations in the resize parameters, which are rendered into the final <img style=...> attribute when a higher-privileged reviewer/admin views the page or preview.

Grav before version 2.0.0-beta.2 contains an XML external entity injection (XXE) vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexml_load_string without disabling external entity loading, enabling attackers to inject XXE payloads via malicious SVG files.

Grav is a file-based web platform. Prior to version 2.0.0-rc.2, the Twig sandbox allow-list permitted any user with the admin.pages role to call config.toArray() within a page body, dumping the entire merged site configuration, including all plugin secrets.

In Grav prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Markdown media action syntax. Markdown image query parameters are converted into callable media actions, allowing the public attribute() method to be reached and an arbitrary HTML attribute to be set on the generated image element. The vulnerability is fixed in 2.0.0-beta.2.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, a low-privileged user could inject an svg element, leading to an XSS attack that could escalate to dumping system information available under /admin/config/info when a Super Admin visits the page.

Grav prior to 2.0.0-beta.2 allows a low-privileged user to bypass Twig sandbox restrictions via the grav['accounts'] service. An attacker can load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt.

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint. Attackers can inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

In Grav prior to 1.8.0-beta.27, users with read access to the user account management section of the admin panel can view password hashes of all users, including the admin. This exposure can potentially lead to privilege escalation if an attacker cracks these hashes.

In Grav prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability exists related to the handling of the scheduled_at parameter. The application fails to properly sanitize cron expressions, allowing an attacker to render the admin panel non-functional by manipulating the parameter, such as with a single quote.

In Grav prior to 1.8.0-beta.27, a low-privilege user with page editing privilege can read any server files using the "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user passwords, 2FA secrets, and password reset tokens.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav's Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator.

In Grav prior to 1.8.0-beta.27, a user with user creation privilege can create a new user with a username containing path traversal sequences (e.g., ..\Nijat or ../Nijat), causing the account YAML file to be written outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This stems from weak regex validation in the cleanDangerousTwig method.

Grav, a file-based web platform built in PHP, is vulnerable to a server side template injection (SSTI) attack. Version 1.7.42 and later have a flaw in the `isDangerousFunction()` which allows the execution of malicious code by prepending a double backslash (`\`).