Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints
Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints
Grav is a flat-file CMS that needs no database, which makes it easy to deploy and easy to forget. Six advisories against it were published in October 2026, including CVE-2026-112779, an unauthenticated translation-cache endpoint that stores about 560 KB per request, and CVE-2026-112782, a resource exhaustion flaw that anonymous visitors can trigger. Both are denial-of-service shapes, and both reward a deployment count.
The measurement
Queries ran through the ZoomEye SDK on 27 October 2026 with sub_type=all and pagesize=1.
| Query | Role | Matched total |
| --- | --- | ---: |
| app="Grav" | application fingerprint | 0 |
| title="Grav" | page title text | 3,312 |
| title="Grav" && port=80 | title on port 80 | 1,185 |
| title="Grav" && port=443 | title on port 443 | 1,090 |
| title="Grav" && port=443 && service="http" | title on HTTPS with HTTP service | 13 |
| title="Grav" && http.body="Grav" | title with Grav in the page body | 22 |
No count identifies a host running a version affected by either denial-of-service issue.
Three thousand title matches, twenty-two body matches
title="Grav" returns 3,312. title="Grav" && http.body="Grav" returns 22.
The 99 percent difference is the most useful finding in this set. A page whose title says Grav and whose body contains no mention of the product is, in most cases, not a Grav site. "Grav" is a word in Swedish meaning grave, and it appears in site names, in band names and in ordinary page copy across languages.
Twenty-two survives that filter, and it is a floor rather than a census. A Grav installation whose front end is a theme built for a client may not carry the word in its body, and one that removes it from public output entirely disappears from the query.
The HTTPS service figure repeats an earlier anomaly
title="Grav" && port=443 returns 1,090 but title="Grav" && port=443 && service="http" returns 13.
This is the same pattern the Craft CMS measurement in this series showed: adding service="http" to a port 443 query collapses the count by two orders of magnitude. The explanation is the same, and it is about field semantics. TLS listeners are frequently classified as ssl rather than http in service data, so a conjunction with service="http" excludes most of them.
A service field should therefore not answer whether a site is reachable over HTTPS. The port field answers that question, and the service field reports protocol classification.
What a denial-of-service exposure figure can mean
CVE-2026-112779 stores roughly 560 KB per request in a cache, and CVE-2026-112782 lets anonymous visitors exhaust resources. Neither needs a valid account, so the shape of the risk is availability rather than confidentiality.
For a flat-file CMS, exhaustion is also a disk problem. A translation cache written per language code fills the filesystem of the host, and a full filesystem affects every site on that host. That coupling is what makes the 22 body matches more interesting than their size suggests: they are hosts where the cache endpoint is plausibly reachable, and each one may hold several sites.
What to do with this number
Do not use 3,312 as an affected count. Use 22 as a shortlist, and treat the list as a starting point for a manual check rather than a population estimate.
If you run Grav, verify the version against the six October advisories, and consider whether the unauthenticated translation endpoint needs to exist at all. A site that serves one language does not need a per-language cache endpoint exposed to the internet, and removing the route costs less than patching it.
Then check the disk quota on the host. The failure mode for both issues is a full volume, and a container or a user account with a hard quota turns a resource exhaustion attack into a contained incident.
References
- ZoomEye cyberspace search, queried 27 October 2026 with sub_type=all
- NVD record for CVE-2026-112779
- NVD record for CVE-2026-112782
- Grav security advisory GHSA-8pcm-97fc-4xwh
- ZoomEye search syntax reference
Mentions
Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints Grav is a flat-file CMS that needs no database, which makes it easy to deploy and easy to forget. Six advisories against it were published in October 2026, including CVE-2026-112779, an unauthenticated translation-cache endpoint that stores about 560 KB per request, and CVE-2026-112782, a resource exhaustion flaw that anonymous visitors can trigger. Both are denial-of-service shapes, and both reward a deployment count. The measurement Queries ran through the ZoomEye SDK on 27 October 2026 with sub_type=all and pagesize=1. | Query | Role | Matched total | | --- | --- | ---: | | app="Grav" | application fingerprint | 0 | | title="Grav" | page title text | 3,312 | | title="Grav" && port=80 | title on port 80 | 1,185 | | title="Grav" && port=443 | title on port 443 | 1,090 | | title="Grav" && port=443 && service="http" | title on HTTPS with HTTP service | 13 | | title="Grav" && http.body="Grav" | title with Grav in the page body | 22 | No count identifies a host running a version affected by either denial-of-service issue. Three thousand title matches, twenty-two body matches title="Grav" returns 3,312. title="Grav" && http.body="Grav" returns 22. The 99 percent difference is the most useful finding in this set. A page whose title says Grav and whose body contains no mention of the product is, in most cases, not a Grav site. "Grav" is a word in Swedish meaning grave, and it appears in site names, in band names and in ordinary page copy across languages. Twenty-two survives that filter, and it is a floor rather than a census. A Grav installation whose front end is a theme built for a client may not carry the word in its body, and one that removes it from public output entirely disappears from the query. The HTTPS service figure repeats an earlier anomaly title="Grav" && port=443 returns 1,090 but title="Grav" && port=443 && service="http" returns 13. This is the same pattern the Craft CMS measurement in this series showed: adding service="http" to a port 443 query collapses the count by two orders of magnitude. The explanation is the same, and it is about field semantics. TLS listeners are frequently classified as ssl rather than http in service data, so a conjunction with service="http" excludes most of them. A service field should therefore not answer whether a site is reachable over HTTPS. The port field answers that question, and the service field reports protocol classification. What a denial-of-service exposure figure can mean CVE-2026-112779 stores roughly 560 KB per request in a cache, and CVE-2026-112782 lets anonymous visitors exhaust resources. Neither needs a valid account, so the shape of the risk is availability rather than confidentiality. For a flat-file CMS, exhaustion is also a disk problem. A translation cache written per language code fills the filesystem of the host, and a full filesystem affects every site on that host. That coupling is what makes the 22 body matches more interesting than their size suggests: they are hosts where the cache endpoint is plausibly reachable, and each one may hold several sites. What to do with this number Do not use 3,312 as an affected count. Use 22 as a shortlist, and treat the list as a starting point for a manual check rather than a population estimate. If you run Grav, verify the version against the six October advisories, and consider whether the unauthenticated translation endpoint needs to exist at all. A site that serves one language does not need a per-language cache endpoint exposed to the internet, and removing the route costs less than patching it. Then check the disk quota on the host. The failure mode for both issues is a full volume, and a container or a user account with a hard quota turns a resource exhaustion attack into a contained incident. References - ZoomEye cyberspace search, queried 27 October 2026 with sub_type=all - NVD record for CVE-2026-112779 - NVD record for CVE-2026-112782 - Grav security advisory GHSA-8pcm-97fc-4xwh - ZoomEye search syntax reference
GitHub - getgrav/grav: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony · GitHub getgrav/grav お疲れ様でした、おれも影響範囲だった