Grav Plugin API CVE-2026-11982

Exploitation requires an authenticated session with at least editor-level (non-superadmin) privileges on the target Grav installation - unauthenticated access is not sufficient per the PR:L CVSS metric. The grav-plugin-api (Admin2) plugin must be installed and the REST API must be reachable over the network. The targeted content field must not have xss_check: false set in its blueprint definition; fields that explicitly opt out of XSS checking are trusted by design and remain unaffected by this fix. A victim user (administrator or visitor) must subsequently load the page containing the injected payload - stored XSS does not execute until the poisoned page is rendered in a browser. Deployments not using the grav-plugin-api REST plugin, or those restricting API write access exclusively to superadmin accounts, are not exposed to this attack path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scores this at 5.1 (Medium), accurately reflecting two key mitigating factors: exploitation requires a valid low-privileged editor account (PR:L) and a victim must passively load the poisoned page (UI:P). The stored nature of this XSS significantly elevates real-world impact compared to reflected variants - a single successful PATCH request persists the payload across every subsequent page view, potentially targeting administrator sessions persistently. The subsequent-system impact dimensions (SC:L/SI:L) acknowledge cross-session risk such as session cookie theft or admin account takeover. No EPSS score was provided in the input data, leaving probabilistic exploitation likelihood unquantified. No CISA KEV listing exists. However, publicly available exploit code exists: a concrete PoC payload is documented in both the Fluid Attacks advisory and the vendor's regression test. For multi-tenant CMS deployments where untrusted or external contributors hold editor-level API access, this represents a meaningful privilege-escalation path to admin compromise and warrants prioritised patching above its medium base score.

An attacker with a valid editor-level account authenticates to the Grav REST API and issues a PATCH /pages request with a Markdown content body containing a payload such as <img src=x onerror=alert(document.cookie)>; because validateChangedFields() omits the checkSafety() call, the payload is written to the flat-file store without sanitization. When an administrator or site visitor subsequently loads the affected page, the injected handler fires in their browser session, enabling session cookie exfiltration, admin credential theft, or further payload staging. A concrete PoC payload is publicly documented in the Fluid Attacks advisory and the vendor's regression test suite.