Iniciar sesión
Deutsch English Español Polski
Media

Grav CMS Local File Injection

  • Publicada: 24.05.2022
  • Actualizado: 11.10.2026 10:22

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer getgrav/grav >= 1.7.0-beta.1, <= 1.7.0-rc.17, < 1.6.30 1.6.30

Referencias

Puntuación CVSS 5.5/10
Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE)
CWE-22
Plataforma
Composer
Paquete
getgrav/grav
Publicada
24.05.2022
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-r3rg-jrjq-w4mr - CC BY 4.0

Historial de vulnerabilidades: getgrav/grav

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (99) en el archivo
Entradas en total
99
Primera → última
11.2019 09.2026
Sin corrección
6
Explotada en ataques
0

Distribución por gravedad

  • Crítica 7
  • Alta 47
  • Media 41
  • Baja 4

Divulgaciones por año

Gravedad:
  1. Grav CMS Local File Injection esta entrada
    Media · 5.5 CVE-2020-29556 >= 1.7.0-beta.1, <= 1.7.0-rc.17, < 1.6.30 1.6.30
  2. Grav CMS vulnerable to remote code execution via .zip file upload
    Alta · 8.8 CVE-2026-72819 < 2.0.13 2.0.13
  3. Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
    Alta · 9.1 CVE-2026-75837 < 2.0.14 2.0.14
  4. Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
    Crítica · 8.8 CVE-2026-75827 < 2.0.15 2.0.15
  5. Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
    Crítica · 8.7 CVE-2026-75828 < 2.0.15 2.0.15
  6. Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
    Alta · 5.9 CVE-2026-74907 < 2.0.15 2.0.15
  7. Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
    Alta · 8.1 CVE-2026-72695 < 2.0.16 2.0.16
  8. Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
    Alta · 6.5 CVE-2026-72697 < 2.0.16 2.0.16
  9. Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
    Alta · 7.7 CVE-2026-76839 < 2.0.16 2.0.16
  10. Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
    Alta · 7.5 CVE-2026-76846 < 2.0.16 2.0.16
  11. Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
    Alta · 6.5 CVE-2026-72698 < 2.0.16 2.0.16
  12. Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
    Alta CVE-2026-69089 >= 2.0.10, < 2.0.11 2.0.11
  13. Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
    Alta · 8.1 CVE-2026-69088 >= 2.0.7, < 2.0.11 2.0.11
  14. Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
    Alta · 8.8 CVE-2026-65608 >= 1.7.0, < 2.0.9 2.0.9
  15. Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
    Alta · 7.4 CVE-2026-62232 < 2.0.4 2.0.4
  16. Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
    Alta CVE-2026-64850 < 2.0.7 2.0.7
  17. Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
    Alta CVE-2026-62230 < 2.0.4 2.0.4
  18. Grav: Unauthenticated denial of service via unbounded image derivative dimensions
    Alta CVE-2026-53653 >= 2.0.0-beta.1, < 2.0.0-rc.8, < 1.7.53 2.0.0-rc.8, 1.7.53
  19. Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
    Alta · 7.7 CVE-2026-44738 < 2.0.0-rc.2 2.0.0-rc.2
  20. Low-privileged Grav API users can create super-admin accounts via blueprint-upload
    Alta CVE-2026-42844 < 2.0.0-beta.4 2.0.0-beta.4
  21. Grav is Vulnerable to Stored XSS via Tag Injection
    Alta · 8.9 CVE-2026-42611 < 2.0.0-beta.2 2.0.0-beta.2
  22. Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
    Alta CVE-2026-42608 < 2.0.0-beta.2 2.0.0-beta.2
  23. Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
    Alta · 8.1 CVE-2026-42609 < 2.0.0-beta.2 2.0.0-beta.2
  24. Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
    Crítica CVE-2026-56700 < 2.0.0-beta.2 2.0.0-beta.2
  25. Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
    Alta · 8.5 CVE-2026-42612 < 2.0.0-beta.2 2.0.0-beta.2
  26. Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
    Crítica · 9.4 CVE-2026-42613 < 2.0.0-beta.2 2.0.0-beta.2
  27. Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
    Crítica · 9.1 CVE-2026-42607 < 2.0.0-beta.2 2.0.0-beta.2
  28. Grav may be vulnerable to SSRF attack via Twig Templates
    Crítica · 9.1 CVE-2025-66844 <= 1.7.49.5 sin corrección
  29. Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
    Alta CVE-2025-66298 < 1.8.0-beta.27 1.8.0-beta.27
  30. Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
    Alta CVE-2025-66294 < 1.8.0-beta.27 1.8.0-beta.27
  31. Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
    Alta CVE-2025-66297 < 1.8.0-beta.27 1.8.0-beta.27
  32. Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
    Alta · 8.8 CVE-2025-66295 < 1.8.0-beta.27 1.8.0-beta.27
  33. Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
    Alta CVE-2025-66305 < 1.8.0-beta.27 1.8.0-beta.27
  34. Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
    Alta CVE-2025-66301 < 1.8.0-beta.27 1.8.0-beta.27
  35. Grav is vulnerable to Arbitrary File Read
    Alta · 8.5 CVE-2025-66300 < 1.8.0-beta.27 1.8.0-beta.27
  36. Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
    Alta · 8.8 CVE-2025-66299 < 1.8.0-beta.27 1.8.0-beta.27
  37. Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
    Alta · 8.8 CVE-2025-66296 < 1.8.0-beta.27 1.8.0-beta.27
  38. Grav Vulnerable to Arbitrary File Read to Account Takeover
    Alta · 8.5 CVE-2024-34082 < 1.7.46 1.7.46
  39. Server Side Template Injection (SSTI) via Twig escape handler
    Alta · 8.8 CVE-2024-28119 < 1.7.45 1.7.45
  40. Server Side Template Injection (SSTI)
    Alta · 8.8 CVE-2024-28118 < 1.7.45 1.7.45
  41. Server Side Template Injection (SSTI)
    Alta · 8.8 CVE-2024-28117 < 1.7.45 1.7.45
Mostrar más (14) Mostrando 41 de 55

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.