What is the CVSS score of CVE-2025-64059?

CVE-2025-64059 has a CVSS 3.1 base score of 1.8 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Grav CMS CVE-2025-64059

EUVD-2025-210894 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-09-13 mitre

GHSA-2x7f-7273-jx2j

XSS Grav Getgrav

1.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

1.8 LOW

AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

2.4 LOW

Admin panel is a network-accessible web interface (AV:N); requires admin credentials (PR:H) and victim page visit (UI:R); only minimal integrity impact applies.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 13, 2026 - 19:16 vuln.today

DescriptionCVE.org

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

AnalysisAI

Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.

Technical ContextAI

Grav is a flat-file PHP CMS (CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) that stores pages in YAML/Markdown files rather than a database, with an admin panel that exposes a Home Page content editor accepting raw HTML. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied script content entered via the editor is stored without sanitization and later rendered into page output. The architectural context is critical: Grav's admin role is a fully trusted, privileged role with native access to PHP template files, plugin management, and arbitrary file upload - all of which already permit arbitrary code execution, making script injection through the Home Page editor a redundant path with no meaningful privilege escalation.

RemediationAI

No vendor-released patch has been identified at time of analysis - no official Grav security advisory or fix commit is present in the provided references. Given that the vulnerability requires administrator-level credentials, the primary control is strict access governance: restrict the Grav admin role exclusively to fully trusted personnel, enforce multi-factor authentication on all admin accounts, and audit existing admin account holders. For organizations operating multi-tenant or co-admin deployments where trust isolation between admins is a requirement, deploying a Content Security Policy (CSP) header that disallows inline scripts (default-src 'self'; script-src 'self') provides a compensating control, though this may interfere with legitimate Grav admin functionality and requires testing. The disputed nature of this finding suggests a vendor patch may not be forthcoming.