[MEDIUM] Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin

PKSA-rjzr-vkvg-cvmf GHSA-8hgv-xc77-jmcr

Affected version: <=2.0.19

Reported by:
GitHub

[HIGH] Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

PKSA-wh99-p4gt-7bkp CVE-2026-62673 GHSA-vwg3-w8w3-pc79

Affected version: <2.0.4

Reported by:
GitHub