Grav CMS CVE-2025-66843

Exploitation requires an authenticated low-privileged user account that holds permission to edit page content in the Grav admin/page-editing functionality - i.e. a multi-author or delegated-editor deployment; a single-admin install with no untrusted editors is not meaningfully exposed. The payload is injected into editable page fields and stored server-side, but execution is gated on required user interaction (UI:R): a second user must view or edit the affected page before the script runs. Affected versions are Grav prior to v1.7.49.5; upgrading to v1.7.49.5 or later remediates. The principal limiting factors are the pre-existing editor privilege and the victim-interaction requirement, which together reduce realistic risk below the raw network-vector reading.

This is a moderate-severity Stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) that realistically sits in the medium-priority band rather than the drop-everything tier. The CVSS vector confirms network reachability and low attack complexity, but materially constrains exploitation: PR:L means the attacker must already hold an authenticated low-privileged content-editor account, and UI:R means a second user must view or edit the poisoned page for the payload to fire. The scope change (S:C) and C:L/I:L reflect that the injected script executes in the browser context of other users - potentially including administrators - which is the real amplification path. On the exploitation side, publicly available exploit code exists (referenced GitHub issue), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation; POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. Net: a credible, patchable abuse-of-privilege web flaw whose real-world risk is gated by the need for a pre-existing low-priv account and victim interaction, most dangerous in multi-author Grav installs where a low-trust editor can escalate against higher-privileged users.

A multi-author Grav site grants a low-trust contributor edit permissions on content. That contributor saves a page with a malicious <script> payload in an editable field; the payload persists server-side and executes in the browser of any admin or editor who later opens or previews that page, enabling session/cookie theft or actions in the victim's authenticated context. Public exploit code for this issue is already available, lowering the barrier to reproduction.