# Getgrav Grav


- [CVE-2023-34251](https://insights.sbomify.com/CVE-2023-34251/): Grav Server Side Template Injection vulnerability (critical 10.0)
- [CVE-2025-46199](https://insights.sbomify.com/CVE-2025-46199/): Cross-site scripting in n/a (critical 9.8)
- [CVE-2021-47812](https://insights.sbomify.com/CVE-2021-47812/): GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2) (critical 9.3)
- [CVE-2025-66844](https://insights.sbomify.com/CVE-2025-66844/): Grav may be vulnerable to SSRF attack via Twig Templates (critical 9.1)
- [CVE-2022-2073](https://insights.sbomify.com/CVE-2022-2073/): Code Injection in getgrav/grav (critical 9.1)
- [CVE-2026-42611](https://insights.sbomify.com/CVE-2026-42611/): Grav: Stored XSS via Tag Injection (high 8.9)
- [CVE-2026-42608](https://insights.sbomify.com/CVE-2026-42608/): Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. (high 8.8)
- [CVE-2025-66295](https://insights.sbomify.com/CVE-2025-66295/): Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption (high 8.8)
- [CVE-2025-66296](https://insights.sbomify.com/CVE-2025-66296/): Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover (high 8.8)
- [CVE-2025-66299](https://insights.sbomify.com/CVE-2025-66299/): Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS (high 8.8)
- [CVE-2025-46198](https://insights.sbomify.com/CVE-2025-46198/): Cross-site scripting in n/a (high 8.8)
- [CVE-2024-27921](https://insights.sbomify.com/CVE-2024-27921/): Grav File Upload Path Traversal vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/getgrav/grav/