Iniciar sesión
Deutsch English Español Polski
Baja

Grav Cross-site Scripting vulnerability

  • Publicada: 06.01.2025
  • Actualizado: 11.10.2026 10:22

A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer getgrav/grav <= 1.7.45 sin corrección

Referencias

Puntuación CVSS -
Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Debilidad (CWE)
CWE-79
Plataforma
Composer
Paquete
getgrav/grav
Publicada
06.01.2025
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m78c-qx99-mvw9 - CC BY 4.0

Historial de vulnerabilidades: getgrav/grav

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (99) en el archivo
Entradas en total
99
Primera → última
11.2019 09.2026
Sin corrección
6
Explotada en ataques
0

Distribución por gravedad

  • Crítica 7
  • Alta 47
  • Media 41
  • Baja 4

Divulgaciones por año

Gravedad:
  1. Grav CMS vulnerable to remote code execution via .zip file upload
    Alta · 8.8 CVE-2026-72819 < 2.0.13 2.0.13
  2. Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
    Alta · 9.1 CVE-2026-75837 < 2.0.14 2.0.14
  3. Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
    Crítica · 8.8 CVE-2026-75827 < 2.0.15 2.0.15
  4. Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
    Crítica · 8.7 CVE-2026-75828 < 2.0.15 2.0.15
  5. Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
    Alta · 5.9 CVE-2026-74907 < 2.0.15 2.0.15
  6. Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
    Alta · 8.1 CVE-2026-72695 < 2.0.16 2.0.16
  7. Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
    Alta · 6.5 CVE-2026-72697 < 2.0.16 2.0.16
  8. Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
    Alta · 7.7 CVE-2026-76839 < 2.0.16 2.0.16
  9. Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
    Alta · 7.5 CVE-2026-76846 < 2.0.16 2.0.16
  10. Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
    Alta · 6.5 CVE-2026-72698 < 2.0.16 2.0.16
  11. Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images
    Alta CVE-2026-69089 >= 2.0.10, < 2.0.11 2.0.11
  12. Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure
    Alta · 8.1 CVE-2026-69088 >= 2.0.7, < 2.0.11 2.0.11
  13. Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
    Alta · 8.8 CVE-2026-65608 >= 1.7.0, < 2.0.9 2.0.9
  14. Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge
    Alta · 7.4 CVE-2026-62232 < 2.0.4 2.0.4
  15. Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
    Alta CVE-2026-64850 < 2.0.7 2.0.7
  16. Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
    Alta CVE-2026-62230 < 2.0.4 2.0.4
  17. Grav: Unauthenticated denial of service via unbounded image derivative dimensions
    Alta CVE-2026-53653 >= 2.0.0-beta.1, < 2.0.0-rc.8, < 1.7.53 2.0.0-rc.8, 1.7.53
  18. Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
    Alta · 7.7 CVE-2026-44738 < 2.0.0-rc.2 2.0.0-rc.2
  19. Low-privileged Grav API users can create super-admin accounts via blueprint-upload
    Alta CVE-2026-42844 < 2.0.0-beta.4 2.0.0-beta.4
  20. Grav is Vulnerable to Stored XSS via Tag Injection
    Alta · 8.9 CVE-2026-42611 < 2.0.0-beta.2 2.0.0-beta.2
  21. Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
    Alta CVE-2026-42608 < 2.0.0-beta.2 2.0.0-beta.2
  22. Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
    Alta · 8.1 CVE-2026-42609 < 2.0.0-beta.2 2.0.0-beta.2
  23. Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
    Crítica CVE-2026-56700 < 2.0.0-beta.2 2.0.0-beta.2
  24. Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
    Alta · 8.5 CVE-2026-42612 < 2.0.0-beta.2 2.0.0-beta.2
  25. Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
    Crítica · 9.4 CVE-2026-42613 < 2.0.0-beta.2 2.0.0-beta.2
  26. Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
    Crítica · 9.1 CVE-2026-42607 < 2.0.0-beta.2 2.0.0-beta.2
  27. Grav may be vulnerable to SSRF attack via Twig Templates
    Crítica · 9.1 CVE-2025-66844 <= 1.7.49.5 sin corrección
  28. Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
    Alta CVE-2025-66298 < 1.8.0-beta.27 1.8.0-beta.27
  29. Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
    Alta CVE-2025-66294 < 1.8.0-beta.27 1.8.0-beta.27
  30. Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
    Alta CVE-2025-66297 < 1.8.0-beta.27 1.8.0-beta.27
  31. Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
    Alta · 8.8 CVE-2025-66295 < 1.8.0-beta.27 1.8.0-beta.27
  32. Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
    Alta CVE-2025-66305 < 1.8.0-beta.27 1.8.0-beta.27
  33. Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
    Alta CVE-2025-66301 < 1.8.0-beta.27 1.8.0-beta.27
  34. Grav is vulnerable to Arbitrary File Read
    Alta · 8.5 CVE-2025-66300 < 1.8.0-beta.27 1.8.0-beta.27
  35. Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
    Alta · 8.8 CVE-2025-66299 < 1.8.0-beta.27 1.8.0-beta.27
  36. Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
    Alta · 8.8 CVE-2025-66296 < 1.8.0-beta.27 1.8.0-beta.27
  37. Grav Cross-site Scripting vulnerability esta entrada
    Baja CVE-2024-35498 <= 1.7.45 sin corrección
  38. Grav Vulnerable to Arbitrary File Read to Account Takeover
    Alta · 8.5 CVE-2024-34082 < 1.7.46 1.7.46
  39. Server Side Template Injection (SSTI) via Twig escape handler
    Alta · 8.8 CVE-2024-28119 < 1.7.45 1.7.45
  40. Server Side Template Injection (SSTI)
    Alta · 8.8 CVE-2024-28118 < 1.7.45 1.7.45
  41. Server Side Template Injection (SSTI)
    Alta · 8.8 CVE-2024-28117 < 1.7.45 1.7.45
  42. Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
    Alta · 8.8 CVE-2024-28116 < 1.7.45 1.7.45
  43. Grav File Upload Path Traversal
    Alta · 8.8 CVE-2024-27921 < 1.7.45 1.7.45
  44. Remote Code Execution by uploading a phar file using frontmatter
    Alta · 8.8 CVE-2024-27923 < 1.7.43 1.7.43
  45. grav Server-side Template Injection (SSTI) mitigation bypass
    Alta · 7.2 CVE-2023-37897 < 1.7.42.2 1.7.42.2
  46. Grav Server-side Template Injection (SSTI) via Twig Default Filters
    Alta · 7.2 CVE-2023-34448 < 1.7.42 1.7.42
  47. Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability
    Alta · 7.2 CVE-2023-34253 < 1.7.42 1.7.42
  48. Grav Server-side Template Injection (SSTI) via Twig Default Filters
    Alta · 7.2 CVE-2023-34252 < 1.7.42 1.7.42
  49. Grav Server Side Template Injection (SSTI) vulnerability
    Crítica · 9.1 CVE-2023-34251 < 1.7.42 1.7.42
  50. Code injection in grav
    Alta · 7.2 CVE-2022-2073 < 1.7.34 1.7.34
  51. Grav CMS Arbitrary File Deletion
    Alta · 8.1 CVE-2020-29555 >= 1.7.0-beta.1, <= 1.7.0-rc.17, < 1.6.30 1.6.30
  52. Grav CMS Cross-Site Request Forgery (CSRF)
    Alta · 8.8 CVE-2020-29553 >= 1.7.0-beta.1, <= 1.7.0-rc.17, < 1.6.30 1.6.30
  53. Stored Cross-site Scripting in grav
    Alta · 7.1 CVE-2022-0970 < 1.7.31 1.7.31
  54. Path traversal in grav
    Alta · 8.8 CVE-2021-3924 <= 1.7.24 sin corrección
  55. Grav's Twig processing allowing dangerous PHP functions by default
    Alta · 8.4 CVE-2021-29440 < 1.7.11 1.7.11

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.