CVE-2026-61453
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Grav v2.0.0 contains a cross-site scripting vulnerability, fixed in 2.0.1. The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.
Risk Assessment
The risk for the organization is the execution of arbitrary JavaScript in users' browsers, which can lead to session theft, data leakage, or further attacks on site visitors.
Recommendation
It is recommended to immediately update Grav to version 2.0.1 or later. If an update is not possible, disable the twig_content.process_enabled option in the configuration to prevent exploitation.
Other vulnerabilities in Grav
See all- CVE-2026-109326High
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
- CVE-2026-100668Medium
Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter is allowlisted but lacks the sandbox guard, allowing access to the raw DI container and disclosure of the full configuration tree, including credentials and secrets, to anonymous visitors.
- CVE-2026-44738High
Grav is a file-based web platform. Prior to version 2.0.0-rc.2, the Twig sandbox allow-list permitted any user with the admin.pages role to call config.toArray() within a page body, dumping the entire merged site configuration, including all plugin secrets.
- CVE-2026-42611High
Grav is a file-based web platform. Prior to version 2.0.0-beta.2, a low-privileged user could inject an svg element, leading to an XSS attack that could escalate to dumping system information available under /admin/config/info when a Super Admin visits the page.
- CVE-2026-75837Critical
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities.
- CVE-2026-65008Critical
Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData(). The function passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command executes as the web-server user whenever anyone – including an unauthenticated visitor – accesses the page.
- CVE-2025-66844Critical
In grav before 1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
- CVE-2025-66301Critical
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities. This vulnerability is fixed in 1.8.0-beta.27.
- CVE-2026-109325High
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
- CVE-2026-109324Medium
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twig or Markdown transform so GD or Imagick decodes the full source without dimension checks, letting anonymous requests repeatedly cause page unavailability.
Original NVD description (English source)
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS