- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 113
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://getgrav.org
Products and areas 11
- Configuration handling, including the YAML parsing and the settings an administrator can change from the browser
- Media and file upload handling, including type checking, archive extraction and the routes that serve uploaded files back
- The admin plugin and every panel inside it, the surface the great majority of the published record is triggered from
- The command-line tools bin/grav and bin/gpm, and the scheduler that runs work on a timer
- The forms plugin and its handlers, which accept input from anonymous visitors on a public site
- The page and content store, since pages are files on disk and the identifiers that address them come from request input
- The plugin and theme installer, which fetches packages from the Grav package manager and unpacks them into a running site
- The policy routes any security issue to the project email and then to a GitHub advisory. The only boundary it draws is version support: 2.0.x active, 1.7.x for critical issues exploitable without admin or publisher access
- The role and permission model, in particular the boundary between an administrator, a publisher and a lower-privileged editor, which the project's own guidelines make central
- The Twig templating layer, and anywhere page content or a configuration value is evaluated as a template rather than rendered as data
- The user account system backed by YAML files, along with login, two-factor handling, registration and password reset
Out of scope (6)
- Behaviour that falls inside the trust scope of the role which triggers it, which the policy reclassifies or closes regardless of the CVSS number
- Reports routed through third-party security reporting services, which the policy asks researchers not to use
- Server and deployment configuration, including web-server rules that expose the user or config directories
- Third-party plugins and themes from the package manager that the core team does not maintain
- Upstream PHP and library defects, unless Grav's own use of them is what makes the issue reachable
- Versions outside support: 1.8.x, anything below 1.7, and non-critical findings against 1.7.x, which only receives backports for critical issues exploitable without admin or publisher access
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Email the address on the policy page first with a detailed explanation.
-
Only once the maintainers agree it is a legitimate issue does the policy ask you to file an advisory on getgrav/grav
-
The policy asks researchers not to use third-party security reporting services
-
Target 2.0.x, where every security fix lands.
Not accepted
-
Behaviour that falls inside the trust scope of the role which triggers it
-
Third-party plugins and themes from the package manager that the core team does not maintain
-
Upstream PHP and library defects, unless Grav's own use of them is what makes the issue reachable
-
Server and deployment configuration, including web-server rules that expose the user or config directories
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-59193 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, or directory depth. This issue is fixed in version 2.0.0. | Medium 6.9 | 10 Jul 2026 |
| CVE-2020-37256 | Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access. | Medium 5.1 | 25 Jun 2026 |
| CVE-2026-42844 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17. | High 8.7 | 12 May 2026 |
| CVE-2026-44738 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray() from within a page body, dumping the entire merged site configuration — including all plugin secrets (SMTP passwords, AWS keys, OAuth client secrets, API tokens) — into the rendered HTML. No administrator privileges are required. This vulnerability | High 7.7 | 11 May 2026 |
| CVE-2026-42843 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API plugin (UsersController::update) allows any authenticated user with basic API access (api.access) to modify their own permission configuration. An attac | High 8.8 | 11 May 2026 |
| CVE-2026-42841 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, | Medium 6.9 | 11 May 2026 |
| CVE-2026-42609 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator. By creating a new user with a username that already exists, the system updates the existing account's metadata and permissions instead of rejecting the | High 8.1 | 11 May 2026 |
| CVE-2026-42610 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor with only pages.update permissions) can bypass the existing Twig sandbox restrictions by utilizing the grav['accounts'] service. Attacker can programmatically load administrative user objects and extract sensitive data, including Bcrypt password hashes and the security salt. This vulnerability is fi | Medium 6.5 | 11 May 2026 |
| CVE-2026-42611 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromi | High 8.9 | 11 May 2026 |
| CVE-2026-42612 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss() function when handling unquoted HTML event attributes. This vulnerability is fixed in 2.0.0-beta.2. | High 8.5 | 11 May 2026 |
| CVE-2026-42608 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to una | High 8.8 | 11 May 2026 |
| CVE-2026-29924 | Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin. | High 7.6 | 30 Mar 2026 |
| CVE-2021-47812 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution. | Critical 9.3 | 16 Jan 2026 |
| CVE-2025-66843 | grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page. | Medium 5.4 | 15 Dec 2025 |
| CVE-2025-66844 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered | Critical 9.1 | 15 Dec 2025 |
| CVE-2025-65186 | Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface. | Medium 6.1 | 2 Dec 2025 |
| CVE-2025-66307 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. Thi | Medium 6.5 | 1 Dec 2025 |
| CVE-2025-66308 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected | Medium 6.8 | 1 Dec 2025 |
| CVE-2025-66309 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] paramet | Medium 6.2 | 1 Dec 2025 |
| CVE-2025-66310 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The s | Medium 6.2 | 1 Dec 2025 |
| CVE-2025-66311 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][metadata], data[header][ta | Medium 6.2 | 1 Dec 2025 |
| CVE-2025-66312 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[readableName] parameter. | Medium 6.2 | 1 Dec 2025 |
| CVE-2025-66301 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes | High 8.6 | 1 Dec 2025 |
| CVE-2025-66302 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling acc | Medium 6.8 | 1 Dec 2025 |
| CVE-2025-66303 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of scheduled_at parameters. Specifically, the application fails to properly sanitize input for cron expressions. By manipulating the scheduled_at parameter with a malicious input, such as a single quote, the application admin panel becomes non-funct | Medium 4.9 | 1 Dec 2025 |
| CVE-2025-66304 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes. This vulnerability is fixed in 1.8.0-beta.27. | Medium 6.2 | 1 Dec 2025 |
| CVE-2025-66305 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel (/admin/config/system). Specifically, the Supported parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (/) or an XSS test string—it causes a fatal regular expr | Medium 6.9 | 1 Dec 2025 |
| CVE-2025-66306 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed, increasing the risk of phishing, credential stuffing, | Medium 4.3 | 1 Dec 2025 |
| CVE-2025-66298 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Template (SST) vulnerability. Sensitive information may be contained in the configuration details. This vulnerability is fixed in 1.8.0-beta.27. | High 7.7 | 1 Dec 2025 |
| CVE-2025-66299 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read | High 8.8 | 1 Dec 2025 |
| CVE-2025-66300 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatter" form. This includes Grav user account files (/grav/user/accounts/*.yaml), which store hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password | High 8.5 | 1 Dec 2025 |
| CVE-2025-66294 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. | High 8.7 | 1 Dec 2025 |
| CVE-2025-66295 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, when a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret | High 8.8 | 1 Dec 2025 |
| CVE-2025-66296 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new password/email, and then log in as that administrator. This effe | High 8.8 | 1 Dec 2025 |
| CVE-2025-66297 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote | High 7.4 | 1 Dec 2025 |
| CVE-2025-63593 | Grav CMS1.7.49.5 is vulnerable to Cross Site Scripting (XSS). | Medium 6.1 | 3 Nov 2025 |
| CVE-2025-50286 | A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access. | High 8.1 | 6 Aug 2025 |
| CVE-2025-46198 | Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element | High 8.8 | 25 Jul 2025 |
| CVE-2025-46199 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields | Critical 9.8 | 25 Jul 2025 |
| CVE-2024-35498 | A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | Medium 6.1 | 6 Jan 2025 |
| CVE-2024-34082 | Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the | High 8.5 | 15 May 2024 |
| CVE-2024-28116 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue. | High 8.8 | 21 Mar 2024 |
| CVE-2024-28117 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any adminis | High 8.8 | 21 Mar 2024 |
| CVE-2024-28118 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twi | High 8.8 | 21 Mar 2024 |
| CVE-2024-28119 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandbox | High 8.8 | 21 Mar 2024 |
| CVE-2024-27921 | Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of | High 8.8 | 21 Mar 2024 |
| CVE-2024-27923 | Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue. | High 8.8 | 21 Mar 2024 |
| CVE-2023-31506 | A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element. | Medium 5.4 | 9 Feb 2024 |
| CVE-2023-49146 | DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. | Medium 6.1 | 22 Nov 2023 |
| CVE-2023-37897 | Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash ( | High 7.2 | 18 Jul 2023 |
| CVE-2023-34253 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for refere | High 8.8 | 14 Jun 2023 |
| CVE-2023-34448 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 o | High 8.8 | 14 Jun 2023 |
| CVE-2023-34452 | Grav is a flat-file content management system. In versions 1.7.42 and prior, the "/forgot_password" page has a self-reflected cross-site scripting vulnerability that can be exploited by injecting a script into the "email" parameter of the request. While this vulnerability can potentially allow an attacker to execute arbitrary code on the user's browser, the impact is limited as it requires user in | Medium 5.4 | 14 Jun 2023 |
| CVE-2023-34251 | Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue. | Critical 9.9 | 14 Jun 2023 |
| CVE-2023-34252 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker wit | High 8.8 | 14 Jun 2023 |
| CVE-2022-2073 | Code Injection in GitHub repository getgrav/grav prior to 1.7.34. | High 7.2 | 29 Jun 2022 |
| CVE-2022-1173 | stored xss in GitHub repository getgrav/grav prior to 1.7.33. | Medium 5.4 | 26 Apr 2022 |
| CVE-2022-0970 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. | Medium 5.4 | 15 Mar 2022 |
| CVE-2022-0743 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. | Medium 4.6 | 28 Feb 2022 |
| CVE-2022-0268 | Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28. | Medium 5.4 | 25 Jan 2022 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 98 Last 12 months 113 Lifetime Code execution 30 % Access control 25 % XSS 25 % Path traversal 20 % Latest advisories Loading the feed Overview Grav is a flat-file PHP CMS with no database, shipped as a zip you unpack on a host. The install base is genuinely unknown: there is no official Docker image and Composer is not the distribution channel, so no defensible deployment number exists. The advisory stream is the reason to care. Ninety-eight GitHub advisories landed in the last twelve months out of 113 ever published, four critical and 47 high, and 96 of the 98 credit a named reporter drawn from more than twenty individuals. One of them is remote code execution through a .zip upload against 2.0.12. The project states it has no resources for bounties, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy routes any security issue to the project email and then to a GitHub advisory. The only boundary it draws is version support: 2.0.x active, 1.7.x for critical issues exploitable without admin or publisher access The admin plugin and every panel inside it, the surface the great majority of the published record is triggered from The page and content store, since pages are files on disk and the identifiers that address them come from request input Media and file upload handling, including type checking, archive extraction and the routes that serve uploaded files back The Twig templating layer, and anywhere page content or a configuration value is evaluated as a template rather than rendered as data The plugin and theme installer, which fetches packages from the Grav package manager and unpacks them into a running site The user account system backed by YAML files, along with login, two-factor handling, registration and password reset The role and permission model, in particular the boundary between an administrator, a publisher and a lower-privileged editor, which the project's own guidelines make central The forms plugin and its handlers, which accept input from anonymous visitors on a public site The command-line tools bin/grav and bin/gpm , and the scheduler that runs work on a timer Configuration handling, including the YAML parsing and the settings an administrator can change from the browser Out of scope Versions outside support: 1.8.x, anything below 1.7, and non-critical findings against 1.7.x, which only receives backports for critical issues exploitable without admin or publisher access Behaviour that falls inside the trust scope of the role which triggers it, which the policy reclassifies or closes regardless of the CVSS number Reports routed through third-party security reporting services, which the policy asks researchers not to use Third-party plugins and themes from the package manager that the core team does not maintain Upstream PHP and library defects, unless Grav's own use of them is what makes the issue reachable Server and deployment configuration, including web-server rules that expose the user or config directories Most-valued findings Unauthenticated code execution. Only four of the 98 advisories in the window reached critical, so a path that needs no login at all is the rarest and most valuable shape here Archive and upload handling, the class GHSA-r94f-hx44-8jqf landed in with remote code execution through a .zip upload against Grav 2.0.12 Anything a page editor reaches that the project does not already consider in scope for that role, since the maintainers close impact that a publisher or administrator was trusted to have anyway Path traversal in the file-backed page and media store, where an identifier resolves outside the site tree to read or write an arbitrary file Twig injection, where content or configuration a lower-privileged user controls is evaluated as a template on the server Account and session defects in the YAML-backed user store, covering login, password reset and two-factor enrolment The plugin and theme installer, where the package fetch or the unpack step becomes code execution Anything critical enough to be exploitable without admin or publisher access, since that is precisely the bar the project sets for backporting a fix to 1.7.x Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] first with a detailed explanation. Only once the maintainers agree it is a legitimate issue does the policy ask you to file an advisory on getgrav/grav The policy asks researchers not to use third-party security reporting services, stating a preference for keeping everything inside the GitHub ecosystem Severity is policed. Reports filed at High or Critical that do not meet the project's guidelines get reclassified or closed, and the policy states the CVSS score the advisory form computes does not override those guidelines Trust scope is the reason: the project treats behaviour that is in scope for the role which triggers it as expected, however bad the impact number looks Target 2.0.x, where every security fix lands. 1.7.x receives backports only for critical issues exploitable without admin or publisher access, and 1.8.x and anything below 1.7 are unsupported Credit on the published advisory is the reward. The project says plainly it lacks the resources to offer bounties Disclosure Coordinated by email with the maintainers, then published as a GHSA on getgrav/grav alongside a release. Publication is heavily batched and release-tied: 33 advisories in June 2026, 28 in July and 20 in December 2025. Plan for an embargo that runs to the next release rather than to a fixed number of days, and expect a credited entry on the advisory itself. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability