CVE-2026-72702
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with) with no trailing delimiter. An attacker controlling a domain that begins with the victim site's origin (e.g., https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
Risk Assessment
Risk of bypassing security mechanisms based on the Referer header, potentially enabling CSRF attacks or unauthorized access to features requiring trusted origin.
Recommendation
Update Grav CMS to version 2.0.16 or later, which includes a fix for origin validation.
Other vulnerabilities in Grav CMS
See all- CVE-2026-72827High
Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.
- CVE-2026-72819High
Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation. An authenticated user can upload a ZIP file containing PHP code, bypass name validation using array notation, and write PHP files to the web root for execution.
- CVE-2026-69088High
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. Blueprint::isSafeDynamicCall() only applies its denylist to strings without '::'. An account with page-editing rights (admin.pages) can plant a directive that invokes an arbitrary public static PHP method with attacker-controlled arguments. This allows reading any server-readable file and arbitrary creation/copying of files and directories.
- CVE-2026-56700Critical
Grav CMS before version 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session deserialize untrusted data without class restrictions, enabling PHP object injection and, via a gadget chain, arbitrary code execution. Additionally, InstallCommand's git clone operation does not escape branch, url, and path parameters, allowing OS command injection during plugin/theme installation (requires admin access). A Twig security blocklist bypass (server-side template injection) is also present.
- CVE-2023-34448High
Grav is a flat-file content management system. In versions prior to 1.7.42, there was a server-side template injection vulnerability that allowed remote code execution by not blocking certain built-in functions exposed by Twig.
- CVE-2023-34251Critical
Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection, allowing remote code execution by a user with page editing privileges.
- CVE-2026-72701Low
Grav CMS before version 2.0.16 has a timing vulnerability in Utils::verifyNonce() that uses non-constant-time comparison (===) instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonces byte-by-byte.
- CVE-2026-72698Medium
Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.
- CVE-2026-72697Medium
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.
- CVE-2026-72696High
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.
Original NVD description (English source)
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.