CVE-2025-66303Medium· 4.9▾ SunlitGrav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize i…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes non-functional, causing significant disruptions to administrative operations. The only way to recover from this issue is to manually access the host server and modify the backup.yaml file to correct the corrupted cron expression. This vulnerability is fixed in 1.8.0-beta.27.
grav < 1.8.0grav = 1.8.0Upgrade past the affected range:
grav 1.8.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112782High· 7.5Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2025-66304Medium· 6.2Grav is a file-based Web platform
CVE-2026-117604High· 7.5Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
CVE-2026-116019High· 8.8Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
CVE-2026-114657Medium· 5.7Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
CVE-2026-114660Medium· 6.3Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives