GHSA-wrxc-mr2w-cjpv is a medium-severity (CVSS 6.1) Open Redirect vulnerability in getgrav/grav. EPSS puts its 30-day exploitation probability at 10.9% (96th percentile). A fix is available for getgrav/grav — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-wrxc-mr2w-cjpv by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
getgrav/gravReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | getgrav/grav | all versions | 1.6.23composer require getgrav/grav:^1.6.23 |
Affected Products
gravgetgravDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update getgrav/grav to 1.6.23 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-wrxc-mr2w-cjpv is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
How to detect GHSA-wrxc-mr2w-cjpv
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-wrxc-mr2w-cjpv -u https://target- Template
- Grav < 1.7 - Open Redirect
- Severity
- medium
- Impact
- An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
- Remediation
- Upgrade Grav CMS to version 1.7 or later to fix the open redirect vulnerability.
Template by ProjectDiscovery nuclei-templates (0x_Akoko), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-wrxc-mr2w-cjpv in your dependencies?
Find it across Packagist, including transitive dependencies.