grav

v2.0.11 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 12d Documentation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 3 known CVEs

Topics

cms content content-management doctrine flat-file grav

+9 more

markdown php php7 symfony twig website website-builder website-generation yaml

Affected surfaces

rce_ssrf auth

ReleasePort's take

Moderate signal

editorial:auto 11d

Version 2.0.11 of Grav introduces multiple security hardenings and a new Twig media‑filtering feature.

Why it matters: Security fixes block path traversal, file disclosure, blank pages, script injection, and unescaped output (severities up to 95). The release also adds five Twig methods for filtering page.media by meta.yaml values.

Summary

AI summary

Updates Bugfix, Improved, and New across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	Critical	Prevents arbitrary file read via image watermark path traversal. Prevents arbitrary file read via image watermark path traversal. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	Critical	Restricts dynamic field data providers to a known‑safe allowlist, blocking file disclosure. Restricts dynamic field data providers to a known‑safe allowlist, blocking file disclosure. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Runs content‑security scan once on page save instead of each render, avoiding blank pages. Runs content‑security scan once on page save instead of each render, avoiding blank pages. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Refuses Twig‑assembled disallowed markup (e.g., script tags) on page save. Refuses Twig‑assembled disallowed markup (e.g., script tags) on page save. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Disallows `raw` Twig filter inside editor‑authored content, preventing unescaped output. Disallows `raw` Twig filter inside editor‑authored content, preventing unescaped output. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds Twig methods `filterBy`, `where`, `findBy`, `sortBy`, `groupBy`, and `withMeta` to filter, sort, and group page media by `.meta.yaml` values. Adds Twig methods `filterBy`, `where`, `findBy`, `sortBy`, `groupBy`, and `withMeta` to filter, sort, and group page media by `.meta.yaml` values. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

New

You can now filter, sort, and group a page's media by the values in their .meta.yaml metafiles directly in Twig, with new filterBy, where, findBy, sortBy, groupBy, and withMeta methods on page.media. Fixes #4200.

Bugfix

[security] A page editor can no longer read arbitrary files from the server by pointing an image watermark at a traversal path such as carrier.png?watermark=../secret.png; an editor-supplied watermark path is now confined to the site's media, while operator-configured watermarks and stream URIs are unaffected (GHSA-w3f4-8pj2-599w).
[security] A page-edit account can no longer reach file-disclosure or secret-read functions by naming an arbitrary Class::method as a dynamic field's data provider; qualified providers are now limited to a known-safe allowlist, closing a bypass of the guard added in 2.0.7 and 2.0.9 (GHSA-7pgq-cr25-xvc8, GHSA-cxv3-5jj3-cpgr).
A page is no longer blanked when viewed just because a trusted plugin or shortcode on it outputs markup the content security scan flags, such as an embed, form, or icon; the check that guards against dangerous editor content now runs once when the page is saved rather than every time it is rendered (GHSA-2c4f-86xc-cr74).

Improved

[security] Page content that uses Twig to assemble disallowed markup at render time, such as building an event handler or a <script> tag from separate pieces, is now refused when you save the page instead of being allowed through to visitors.
The raw Twig filter is no longer allowed inside editor-authored page content, so page content can no longer output unescaped dynamic values past the content security check; trusted theme templates are unaffected.

Security Fixes

GHSA-w3f4-8pj2-599w – Prevents arbitrary file read via image watermark path traversal
GHSA-7pgq-cr25-xvc8, GHSA-cxv3-5jj3-cpgr – Restricts dynamic field data providers to an allowlist, closing a secret‑read bypass
GHSA-2c4f-86xc-cr74 – Moves content security scan to page save time, avoiding blank pages on render

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track grav

Get notified when new releases ship.

About grav

Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony

All releases →