How many CVEs have a located fix in getgrav/grav?

42 published CVEs have a fix traced to functions in getgrav/grav, touching 82 functions across 42 files.

Which function in getgrav/grav has been patched by the most CVEs?

detectXss in system/src/Grav/Common/Security.php has been changed by 6 CVE fixes, from 2021 to 2024.

How large is a typical CVE fix in getgrav/grav?

The median fix changes 43 lines. 29% of fixes change 20 lines or fewer, and 31% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

php

#98 of 500 repositories

getgrav/grav

Name: getgrav/grav: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 19, 2026

42

CVE fixes located

Published CVEs

82

Functions patched

Distinct function sites

42

Files patched

Distinct source files

2020–2026

Years covered

By CVE publication date

Overview

42 published CVEs have a fix traced to functions in getgrav/grav, the earliest published in 2020. Those fixes changed 82 distinct functions across 42 files, in 346 patch hunks.

Among the 500 repositories tracked here, getgrav/grav ranks #98 by the number of CVEs with a located fix.

Most patched functions

Functions in getgrav/grav changed by the most CVE fixes.

Most patched files

Files in getgrav/grav changed by the most CVE fixes.

1system/src/Grav/Common/Security.php15 CVEs · 8 functions
2system/src/Grav/Common/Twig/Extension/GravExtension.php10 CVEs · 8 functions
3system/src/Grav/Common/Flex/Types/Users/UserObject.php6 CVEs · 2 functions
4system/src/Grav/Common/Session.php5 CVEs · 4 functions
5system/src/Grav/Common/Twig/Twig.php5 CVEs · 4 functions
6system/defines.php5 CVEs · 0 functions
7system/src/Grav/Common/User/DataUser/User.php4 CVEs · 3 functions
8system/src/Grav/Common/Utils.php4 CVEs · 3 functions
9system/src/Grav/Framework/Cache/Adapter/FileCache.php4 CVEs · 3 functions
10system/src/Grav/Common/Scheduler/JobQueue.php4 CVEs · 2 functions

Fix size

How much code a CVE fix in getgrav/grav changes, with backports counted once.

43

Median lines changed

Added plus removed, per CVE

29%

Fixes of 20 lines or fewer

Share of CVE fixes

31%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in getgrav/grav, and the functions each fix changed.

Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
CVE-2026-64850isSafeDynamicCall dynamicData
High · CVSS 8.7
EPSS 0.5%2026-08-19
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
CVE-2026-62673
High · CVSS 8.2
EPSS 0.5%2026-08-19
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
CVE-2026-62672regexReplace
Medium · CVSS 6.0
EPSS 0.4%2026-08-19
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
CVE-2026-61842scope isClassAllowed getFilters
Medium · CVSS 6.5
EPSS 0.4%2026-08-19
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
CVE-2026-61690extract archiveLimits
Medium · CVSS 6.5
EPSS 0.5%2026-08-19
Grav before 2.0.15 Stored XSS via audio/video source URL
CVE-2026-75831resize parsedownElement
Medium · CVSS 5.1
EPSS 0.4%2026-08-18
Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
CVE-2026-11430encodeAngleBracketDestination processWebhookTrigger webhook
Medium · CVSS 6.9
EPSS 1.0%2026-08-07
Grav CMS before 2.0.11 Path Traversal via watermark
CVE-2026-69089solves time processPage
High · CVSS 8.7
EPSS 0.5%2026-08-03
Grav before 2.0.9 Remote Code Execution via FlexDirectory
CVE-2026-65608encodeAngleBracketDestination inlineImage inlineLink
High · CVSS 8.7
EPSS 1.1%2026-07-23
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
CVE-2026-59193unZip archiveLimits lastErrorMsg
Medium · CVSS 6.9
EPSS 0.6%2026-07-10
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()
CVE-2026-55890id
Medium · CVSS 4.8
EPSS 0.3%2026-07-10
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
CVE-2026-53653fallbackUrl
High · CVSS 8.7
EPSS 0.5%2026-07-10

Get an alert for each new getgrav/grav CVE, with the patched functions and AI-written analysis.

Monitor grav CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

aio-libs/aiohttp42 CVEs directus/directus42 CVEs freescout-help-desk/freescout42 CVEs openstack/nova42 CVEs argoproj/argo-cd43 CVEs coollabsio/coolify43 CVEs grafana/grafana43 CVEs LimeSurvey/LimeSurvey43 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in getgrav/grav.

How many CVEs have a located fix in getgrav/grav?: 42 published CVEs have a fix traced to functions in getgrav/grav, touching 82 functions across 42 files.
Which function in getgrav/grav has been patched by the most CVEs?: detectXss in system/src/Grav/Common/Security.php has been changed by 6 CVE fixes, from 2021 to 2024.
How large is a typical CVE fix in getgrav/grav?: The median fix changes 43 lines. 29% of fixes change 20 lines or fewer, and 31% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track getgrav/grav CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing