getgrav has 126 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 86 in the last 90 days against 23 in the 90 before. The busiest recent month was August 2026 with 46. The median CVSS is 7.2 (high), with 11 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (25) and CWE-200 (15). Most affected products: grav (70), getgrav/grav (30), grav-plugin-api (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 86 prev 23
Weakness classes
Products
- grav 70
- getgrav/grav 30
- grav-plugin-api 10
- grav-plugin-login 4
- grav-plugin-admin 3
- grav-plugin-guestbook 2
Worst active — by depth score
CVE-2026-65008Critical· 9.8Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func…66CVE-2026-61451Critical· 9.6Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url65CVE-2025-66301Critical· 9.6Grav is a file-based Web platform65CVE-2026-75837Critical· 9.1Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction62CVE-2026-85604High· 8.8Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter61
getgrav vulnerabilities
CVEs affecting getgrav, newest first. Open any entry for full detail, references, and exploit status.
126 CVEsRSS
CVE-2025-66299High· 8.8Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypas…
CVE-2025-66298High· 7.5Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side T…
CVE-2025-66297High· 8.8Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, th…
CVE-2025-66296High· 8.8Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permissio…
CVE-2025-66295High· 8.8Grav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat)…
CVE-2025-66294High· 8.8PoCGrav is a file-based Web platform
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, …