Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Grav bug bounty programs

getgrav.org Updated

Grav runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Grav runs.

  • Grav

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://getgrav.org

    Web

  • Configuration handling, including the YAML parsing and the settings an administrator can change from the browser

    Products and areas

  • Media and file upload handling, including type checking, archive extraction and the routes that serve uploaded files back

    Products and areas

  • The admin plugin and every panel inside it, the surface the great majority of the published record is triggered from

    Products and areas

  • The command-line tools bin/grav and bin/gpm, and the scheduler that runs work on a timer

    Products and areas

  • The forms plugin and its handlers, which accept input from anonymous visitors on a public site

    Products and areas

  • The page and content store, since pages are files on disk and the identifiers that address them come from request input

    Products and areas

  • The plugin and theme installer, which fetches packages from the Grav package manager and unpacks them into a running site

    Products and areas

  • The policy routes any security issue to the project email and then to a GitHub advisory. The only boundary it draws is version support: 2.0.x active, 1.7.x for critical issues exploitable without admin or publisher access

    Products and areas

  • The role and permission model, in particular the boundary between an administrator, a publisher and a lower-privileged editor, which the project's own guidelines make central

    Products and areas

  • The Twig templating layer, and anywhere page content or a configuration value is evaluated as a template rather than rendered as data

    Products and areas

  • The user account system backed by YAML files, along with login, two-factor handling, registration and password reset

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Behaviour that falls inside the trust scope of the role which triggers it, which the policy reclassifies or closes regardless of the CVSS number

  • Reports routed through third-party security reporting services, which the policy asks researchers not to use

  • Server and deployment configuration, including web-server rules that expose the user or config directories

  • Third-party plugins and themes from the package manager that the core team does not maintain

  • Upstream PHP and library defects, unless Grav's own use of them is what makes the issue reachable

  • Versions outside support: 1.8.x, anything below 1.7, and non-critical findings against 1.7.x, which only receives backports for critical issues exploitable without admin or publisher access

Recent changes

Reward and scope changes across every Grav program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Grav products, from the NVD.

Search NVD
  • CVE-2026-59193 Medium

    Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0.

  • CVE-2020-37256 Medium

    Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

  • CVE-2026-42844 High

    Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

  • CVE-2026-44738 High

    Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability

  • CVE-2026-42843 High

    Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attac

  • CVE-2026-42841 Medium

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way,

  • CVE-2026-42609 High

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the

  • CVE-2026-42610 Medium

    Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fi

About this page

This page gathers every public program listed under getgrav.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.