DEV Community

yutianle
yutianle

Posted on

Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints

#zoomeye #grav #cms #exposure

Grav shows 3,312 title matches, 22 of them served from behind a Grav-identified body, and zero application fingerprints

Grav is a flat-file CMS that needs no database, which makes it easy to deploy and easy to forget. Six advisories against it were published in October 2026, including CVE-2026-112779, an unauthenticated translation-cache endpoint that stores about 560 KB per request, and CVE-2026-112782, a resource exhaustion flaw that anonymous visitors can trigger. Both are denial-of-service shapes, and both reward a deployment count.

The measurement

Queries ran through the ZoomEye SDK on 27 October 2026 with sub_type=all and pagesize=1.
| Query | Role | Matched total |
| --- | --- | ---: |
| app="Grav" | application fingerprint | 0 |
| title="Grav" | page title text | 3,312 |
| title="Grav" && port=80 | title on port 80 | 1,185 |
| title="Grav" && port=443 | title on port 443 | 1,090 |
| title="Grav" && port=443 && service="http" | title on HTTPS with HTTP service | 13 |
| title="Grav" && http.body="Grav" | title with Grav in the page body | 22 |
No count identifies a host running a version affected by either denial-of-service issue.

Three thousand title matches, twenty-two body matches

title="Grav" returns 3,312. title="Grav" && http.body="Grav" returns 22.
The 99 percent difference is the most useful finding in this set. A page whose title says Grav and whose body contains no mention of the product is, in most cases, not a Grav site. "Grav" is a word in Swedish meaning grave, and it appears in site names, in band names and in ordinary page copy across languages.
Twenty-two survives that filter, and it is a floor rather than a census. A Grav installation whose front end is a theme built for a client may not carry the word in its body, and one that removes it from public output entirely disappears from the query.

The HTTPS service figure repeats an earlier anomaly

title="Grav" && port=443 returns 1,090 but title="Grav" && port=443 && service="http" returns 13.
This is the same pattern the Craft CMS measurement in this series showed: adding service="http" to a port 443 query collapses the count by two orders of magnitude. The explanation is the same, and it is about field semantics. TLS listeners are frequently classified as ssl rather than http in service data, so a conjunction with service="http" excludes most of them.
A service field should therefore not answer whether a site is reachable over HTTPS. The port field answers that question, and the service field reports protocol classification.

What a denial-of-service exposure figure can mean

CVE-2026-112779 stores roughly 560 KB per request in a cache, and CVE-2026-112782 lets anonymous visitors exhaust resources. Neither needs a valid account, so the shape of the risk is availability rather than confidentiality.
For a flat-file CMS, exhaustion is also a disk problem. A translation cache written per language code fills the filesystem of the host, and a full filesystem affects every site on that host. That coupling is what makes the 22 body matches more interesting than their size suggests: they are hosts where the cache endpoint is plausibly reachable, and each one may hold several sites.

What to do with this number

Do not use 3,312 as an affected count. Use 22 as a shortlist, and treat the list as a starting point for a manual check rather than a population estimate.
If you run Grav, verify the version against the six October advisories, and consider whether the unauthenticated translation endpoint needs to exist at all. A site that serves one language does not need a per-language cache endpoint exposed to the internet, and removing the route costs less than patching it.
Then check the disk quota on the host. The failure mode for both issues is a full volume, and a container or a user account with a hard quota turns a resource exhaustion attack into a contained incident.

References

Top comments (0)