Grav CMS CVE-2026-85598

Exploitation requires: (1) an attacker account with page-edit (editor-level) privileges on the target Grav installation - unauthenticated exploitation is not possible; (2) Grav CMS version between 2.0.0 and 2.0.17 inclusive; (3) the modular page feature must be in use (it is a standard Grav feature, not a non-default plugin); (4) a victim - including any administrator - must passively visit the parent page that renders the malicious modular child. What limits exploitation: the PR:L requirement means an attacker must possess or compromise valid editor credentials before the attack can be staged; there is no unauthenticated or network-only path. The attack does not require any special server configuration beyond standard Grav operation.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) accurately reflects the constrained impact: exploitation requires authenticated access with page-edit rights (PR:L) and passive user interaction from a victim (UI:P), and direct system impact is nil (VC:N/VI:N/VA:N). Subsequent-system impact is assessed as Low confidentiality and Low integrity (SC:L/SI:L), which is conservative - if the victim is an administrator, the practical integrity impact could be significantly higher through session theft or forced actions. The EPSS score is not provided in the source data, so probability of exploitation cannot be quantified independently. There is no KEV listing and no reported POC, suggesting this is not under active or opportunistic mass exploitation. That said, even a mid-sized municipal IT team in walbrzych running a Grav-based public portal with multiple content editors should treat this as a meaningful insider-threat or supply-chain-risk scenario: any editor with malicious intent or compromised credentials can silently backdoor all page visitors. The attack complexity is genuinely low once editor credentials are obtained. The principal limiting factor is the PR:L requirement - without editor-level credentials, remote exploitation is not possible.

A low-privileged content editor with page-edit rights logs into the Grav admin panel and creates a modular page containing a Twig block that outputs a JavaScript payload stealing session cookies. When a site administrator later visits the parent page, the malicious script executes silently in their browser, exfiltrating the admin session token to an attacker-controlled server. No public POC has been identified, but the attack requires only basic Twig knowledge and standard editor credentials.