grav

v2.0.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Documentation

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

cms content content-management doctrine flat-file grav

+9 more

markdown php php7 symfony twig website website-builder website-generation yaml

Affected surfaces

rce_ssrf auth

Summary

AI summary

Security fixes close decompression‑bomb and XSS bypass vulnerabilities in ZIP archives and Twig rendering.

Full changelog

[security] ZIP archives extracted through the internal ZipArchiver are now rejected when their contents exceed safe limits on total uncompressed size, file count, or folder nesting depth, closing a second extraction path with the same decompression-bomb risk that was fixed for Direct Install (GHSA-928x-9mpw-8h56).
[security] Editor-authored Twig in page content now has its rendered output re-checked for XSS, closing a bypass where a payload assembled at render time (such as {{ "on" ~ "error" }}) passed the source validator and then emitted live markup (GHSA-2c4f-86xc-cr74).
A page marked Visible in the admin no longer vanishes from navigation after saving, because a blank visibility setting now falls back to its normal default instead of being read as hidden (#4153).

GHSA-928x-9mpw-8h56 — Rejects ZIP archives that exceed safe uncompressed size, file count, or folder depth limits to prevent decompression‑bomb attacks.
GHSA-2c4f-86xc-cr74 — Re‑validates rendered Twig output for XSS, closing a bypass where concatenated strings formed malicious markup at render time.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track grav

Get notified when new releases ship.

About grav

Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony