p PatchFirst

PatchFirst · Latest vulnerabilities

getgrav/grav 2.0.16: known vulnerabilities

Known vulnerabilities affecting getgrav/grav 2.0.16: 2. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-86197

    Medium · CVSS 5.1EPSS 0.41%Fix available

    Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

    Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.

    getgrav/gravPHP
    • Update to 2.0.20
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-31506

    Medium · CVSS 5.4EPSS 1%No fix published

    CVE-2023-31506

    A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.

    getgrav/gravPHP
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →