Packagist/getgrav/grav CVE-2026-42844: high 8.8, EPSS 0.34%
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
Action: Upgrade getgrav/grav to 2.0.0-beta.4 or later.
composer require getgrav/grav:2.0.0-beta.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0-beta.4 | - |
Fixed versions
| 2.0.0-beta.4 |
Sources
- osv: GHSA-6xx2-m8wv-756h
- nvd: CVE-2026-42844
- https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h
- https://github.com/getgrav/grav-plugin-api/commit/97fc02844a35f743dfe93d34efd92d47eedd5bc5
- https://github.com/getgrav/grav
CVE-2026-42844 · published · modified · JSON