Grav vulnerabilities

Newest CVEs

• CVE-2026-58657

  Grav - Stored CSS Injection via Markdown Image resize() Action

  Grav · Grav

  Medium4.8
• CVE-2026-58654

  Grav - Arbitrary File Upload via Avatar Endpoint

  Grav · Grav

  Medium5.3
• CVE-2026-56700

  Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection

  Grav · Grav

  Critical9.3
• CVE-2020-37256

  Grav - Cross-Site Scripting in Admin Plugin Page Editor

  Grav · Grav

  Medium5.1
• CVE-2026-56701

  Grav - XML External Entity Injection via SVG Upload

  Grav · Grav

  High7.1
• CVE-2026-11982

  Stored XSS via missing XSS safety check in Admin2 Pages API partial validation

  Grav · grav-plugin-api

  Medium5.1
• CVE-2026-7317

  Grav CMS Cache Value FileCache.php doGet deserialization

  Grav · CMS

  Low2.3