Grav CMS <= 2.0.15: Origin Validation Bypass Vulnerability
- Severity
- HIGH
- Affected component
- composer/getgrav/grav (packagist)
- Patched version
- 2.0.16
Grav CMS versions prior to 2.0.16 are reportedly affected by an origin validation bypass vulnerability in the Uri::referrer() and Pages::referrerRoute() methods.
What happened
An origin validation bypass vulnerability has been reported in Grav CMS versions prior to 2.0.16. This vulnerability exists in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match. An attacker who controls a domain that begins with the victim site's origin can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.
The vulnerability was first flagged on August 25, 2026, and is currently under investigation. There is no evidence that this vulnerability has been exploited in the wild. The affected component is composer/getgrav/grav (packagist) with reported affected versions less than 2.0.16. The patched version is 2.0.16.
What to do about it
- Upgrade to Grav CMS version 2.0.16 or later to mitigate the origin validation bypass vulnerability.
- Review your application's use of the Uri::referrer() and Pages::referrerRoute() methods to ensure proper origin validation.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
composer/getgrav/grav is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Grav CMS version 2.0.15 or earlier, you are potentially affected by this vulnerability.
What should I do right now?
Upgrade to Grav CMS version 2.0.16 or later as soon as possible to mitigate the vulnerability.
Is this vulnerability being exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild at this time.