These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-62673 is a HIGH severity vulnerability in Grav, a file-based Web platform. Prior to version 2.0.4, the .htaccess and webserver-configs/htaccess.txt security rules do not use the Apache [NC] flag, leading to case-sensitive comparisons of sensitive directory and file-extension patterns. On case-insensitive filesystems, unauthenticated attackers can bypass security rules using uppercase directory or [truncated]
CVE-2026-62666: Grav API Plugin prior to 1.0.6 has a vulnerability allowing non-super accounts to create API keys with super-admin privileges due to missing access checks in UsersController::createApiKey(), generate2fa(), and disable2fa(). This issue permits rotating or disabling the target's two-factor authentication and obtain the target's full privileges because key scopes are not enforced. The vulnera [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T16:18:16.723Z and has not been modified since then. The NVD entry is currently MEDIUM. This medium-severity vulnerability in the Grav API Plugin for Grav CMS allows an attacker with api.media.write permission to store malicious SVG files that can execute JavaScript when opened by a victim, leadin [truncated]
The Grav API plugin, versions before 1.0.13, contains a vulnerability that allows scoped API keys to write scheduler configuration due to improper enforcement of API key scope caps in ConfigController super-scope gates. This can lead to operating system command execution as the web server user. The vulnerability arises because the scope cap is applied only inside requirePermission(), whereas the scheduler [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-14T12:16:46.157Z and has not been modified since then. The NVD entry is currently Received. This HIGH severity vulnerability (CVSS score of 8.7) affects Grav API plugin versions before 1.0.13, allowing an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enfo [truncated]
The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. This allows an attacker with a minimal-scope API key on a super account to create an unscoped, full-access super key, potentially enabling further exploitation. The vulnerability is rated HIGH with a CVSS score of 8.7, indicating a high severity [truncated]
The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.13 is vulnerable to server-side template injection (SSTI) and remote code execution due to an API key scope-cap bypass in PagesController::guardTwigContent(). This vulnerability allows a least-privilege API key scoped only to api.pages.write to enable process.twig on a page save when security.twig_content.process_enabled=true and editor_enab [truncated]
The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. A holder of a narrow-scope API key on a su [truncated]
The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contains a high-severity privilege escalation vulnerability. The flaw exists in the authenticated profile self-update handler, which fails to strip privilege fields from user-submitted form data. This allows low-privilege authenticated users to escalate privileges to super-admin, potentially enabling admin panel access, scheduler abuse, and Twig [truncated]
CVE-2026-65008 is a remote code execution vulnerability in Grav 2.0.4, which was fixed in version 2.0.7. The vulnerability exists in the Blueprint::dynamicData() method, where a Class::method callable string and its arguments are passed directly to call_user_func_array() without any allowlist. This allows an authenticated account with the admin.pages (or api.pages.write) permission to plant a malicious ca [truncated]
The Grav API plugin before version 1.0.0-rc.16 had a misconfigured CORS setting, allowing unauthorized cross-origin requests. This vulnerability, CVE-2026-62387, was made public on 2026-07-17. The plugin's default configuration included an Access-Control-Allow-Origin header set to *, which could be exploited by attackers to read sensitive data and perform actions as the token's user. The vulnerability is [truncated]
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 has a security vulnerability. It accepts JWT access tokens through the ?token= URL query parameter on every API route due to a fallback in JwtAuthenticator::extractBearerToken. This causes tokens to be logged in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. A le [truncated]
A cross-site request forgery (CSRF) vulnerability exists in grav-plugin-login before version 3.8.11. The vulnerability is located in the login.regenerate2FASecret frontend task, which allows an attacker to regenerate and persist a new TOTP secret for the authenticated session user without proper anti-CSRF measures. This can be exploited by luring a logged-in victim to an off-site page, causing the victim' [truncated]
CVE-2026-62235 is a low-severity vulnerability in Grav Flex-Objects before version 1.4.3. The vulnerability is caused by a broken access control in the admin-next REST API, allowing authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. This can lead to unauthorized access and modification of objects in directories without explicit permi [truncated]
CVE-2026-62233 is a high-severity vulnerability in grav-plugin-api before version 1.0.6. The vulnerability allows non-super admin users with api.users.write manager privileges to escalate to super-admin status by exploiting the createApiKey, generate2fa, and disable2fa endpoints. This could lead to full instance takeover by minting API keys bound to super-admin accounts or stripping 2FA from super-admin users.
CVE-2026-62232 is a critical vulnerability in Grav before 2.0.4 that allows attackers to bypass two-factor authentication (2FA) by regenerating the 2FA secret. This vulnerability has a CVSS score of 9.1 and is considered critical. The vulnerability exists in the login plugin of Grav, where the regenerate2FASecret task only checks for user existence, not authorization, during the pending TOTP challenge win [truncated]
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass vulnerability. API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, allowing a key created with limited scopes (e.g., read-only) to perform any write, delete, or administrative oper [truncated]
CVE-2026-62230 is a high-severity vulnerability in Grav, a popular content management system. The vulnerability arises from the default .htaccess file and reference webserver-configs/htaccess.txt file that ships with Grav versions before 2.0.4. These files contain rules that block access to sensitive file types such as .yaml, .php, and .json. However, these rules lack the [NC] flag, which makes the extens [truncated]
The Grav Admin2 plugin before 2.0.4 discloses sensitive information via a global JavaScript variable. This CVE record was published on 2026-07-11T14:16:23.630Z and has not been modified since then. The vulnerability allows an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance. Users of Grav Admin2 plugin versions before 2.0.4 should update to [truncated]
CVE-2026-59193 is a vulnerability in Grav, a file-based Web platform, where an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. This issue arises because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. The vulnerability is fixed in version 2.0.0. Af [truncated]
CVE-2026-58492 is a critical SQL injection vulnerability in the grav-plugin-database plugin for Grav CMS. The vulnerability allows attacker-controlled table names to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0. Affected deployments should be reviewed for exposure and patched urgently. The grav-plugin-database plugin for Grav CMS has a critical SQL injection [truncated]
CVE-2026-55890 is a stored XSS vulnerability in Grav, a file-based web platform, due to an incomplete fix for CVE-2026-42841. The issue allows an editor to save malicious Markdown image style parameters that are written into the rendered img style attribute without proper sanitization. This vulnerability has a CVSS score of 4.8 and is classified as MEDIUM severity. Users of Grav versions prior to 2.0.0-rc [truncated]
CVE-2026-53653 is a high-severity vulnerability in Grav, a file-based web platform. An unauthenticated visitor can exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions. This issue is fixed in Grav versions 1.7.53 and 2.0.0-rc.8. The vulnerability class is related to image derivative generation, and the likely operational impact is server r [truncated]
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmod [truncated]
CVE-2026-61455 is a high-severity vulnerability in Grav, a popular content management system, caused by a decompression bomb in ZipArchiver::extract(). The vulnerability allows attackers to supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources. This issue affects Grav versions prior to 2.0.1.
CVE-2026-61450 is a high-severity vulnerability in Grav, a popular open-source content management system. The vulnerability allows a page author to bypass the Twig sandbox and exfiltrate configuration secrets, including sensitive information such as SMTP credentials, API keys, and plugin DB credentials. This issue arises from an incomplete fix for a previous vulnerability (GHSA-j274-39qw-32c9). Although t [truncated]
The Grav API plugin before version 1.0.0-rc.16 has a security vulnerability that allows unauthenticated attackers to make fully authenticated cross-origin API requests. This is possible because the plugin accepts JWT tokens via the ?token= URL query parameter and responds with an Access-Control-Allow-Origin: * header. Attackers who obtain a leaked JWT token can create persistent backdoor super-admin accou [truncated]