CMS

getgrav/grav

Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony

#php#cms#flat-file#content#website#grav#content-management#twig#yaml#symfony#doctrine#php7#website-builder#website-generation#markdown

スコア

/ 100

Star

15,491

Fork

1,409

Open Issue

432

サイズ

32MB

言語

PHP ★

最終push

2 日前

Docker

—

採点内訳

過去CVE 17件 (やや多い)

✓

直近 push: 2 日前

✓

得意言語 (PHP)

✓

オープンissue 432件

✓

中規模 (32MB)

✓

Docker 未対応

—

10k–50k: 中級 (★15,491)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

HIGHGHSA-j274-39qw-32c9 CVE-2026-447382026/5/9
Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
MEDIUMGHSA-fmg2-f5r9-24qc CVE-2026-447372026/5/5
Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]
HIGHGHSA-w4rc-p66m-x6qq CVE-2026-428452026/4/29
Anonymous Page Content Overwrite via Form File Upload filename Override
HIGHGHSA-6xx2-m8wv-756h CVE-2026-428442026/4/28
Low-privileged API users can create super-admin accounts via blueprint-upload
HIGHGHSA-w8cg-7jcj-4vv2 CVE-2026-426112026/4/27
Stored XSS via Tag Injection
MEDIUMGHSA-3446-6mgw-f79p2026/4/27
XXE via SVG Upload
HIGHGHSA-hmcx-ch82-3fv2 CVE-2026-426082026/4/27
[ZERO-DAY] Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component.
HIGHGHSA-rr73-568v-28f8 CVE-2026-426092026/4/27
Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
HIGHGHSA-gwfr-jfjf-92vv2026/4/27
Insecure Deserialization in File Cache
CRITICALGHSA-vj3m-2g9h-vm4p2026/4/27
Multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass (CWE-502, CWE-78, CWE-1336)
HIGHGHSA-9695-8fr9-hw5q CVE-2026-426122026/4/27
Publisher-Level Stored XSS via Unquoted Event Attributes
MEDIUMGHSA-3f29-pqwf-v4j4 CVE-2026-426102026/4/27
Sensitive Information Disclosure via Accounts Service Bypass
CRITICALGHSA-pxm6-mhxr-q4mj CVE-2026-426132026/4/27
Privilege Escalation via Missing Server-Side Validation of groups/access
MEDIUMGHSA-c2q3-p4jr-c55f CVE-2026-428422026/4/27
XSS via Taxonomy Field Values in Admin Panel
MEDIUMGHSA-r7fx-8g49-7hhr CVE-2026-428412026/4/27
Stored XSS via Markdown media attribute() action in Grav CMS
CRITICALGHSA-w48r-jppp-rcfw CVE-2026-426072026/4/27
Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
HIGHGHSA-r945-h4vm-h736 CVE-2026-428432026/4/27
Grav API Privilege Escalation to Super Admin
MEDIUMGHSA-q3qx-cp62-f6m7 CVE-2025-663072025/12/1
Grav v1.7.49.5 / Admin v1.10.49.1 – User Enumeration & Email Disclosure
HIGHGHSA-h756-wh59-hhjv CVE-2025-662952025/12/1
Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HIGHGHSA-cjcp-qxvg-4rjm CVE-2025-662962025/12/1
Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover