Grav CMS EUVD-2025-210894

Exploitation requires a fully authenticated Grav administrator account (PR:H per CVSS). The attacker must access the admin panel's Home Page editor, and a victim user must subsequently browse to the affected page (UI:R). Attack scope is local (AV:L per NVD CVSS), not directly network-exploitable by an external unauthenticated party. The most significant limiting factor is the architectural dispute: Grav's admin role already permits template modification, plugin installation, and arbitrary file upload - all of which provide equivalent or greater code execution capability than JavaScript injection via the content editor. This finding has incremental security relevance only in co-admin or multi-tenant deployments where a trust boundary between administrator accounts is explicitly defined and enforced.

The NVD CVSS vector AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N and score of 1.8 is the lowest possible meaningful score and accurately reflects the marginal risk. Exploitation requires a pre-authenticated Grav administrator, High Attack Complexity, local scope, and a victim to interact with the affected page - stacking four independent limiting factors simultaneously. The dispute embedded in the official NVD description is the most operationally significant signal: this is a security-researcher-reported 'admin-to-XSS' finding in a product where admins can already execute code via other built-in mechanisms. No EPSS score was provided in the input data, there is no CISA KEV entry, and no confirmed POC exploit exists in the intelligence provided. This issue does not warrant emergency response for any reasonably configured environment; it is relevant only in multi-tenant or co-admin scenarios where trust boundaries between administrator accounts are a stated security requirement.

An attacker who has already obtained a valid Grav administrator account edits the Home Page content block via the admin panel, inserting a JavaScript payload such as a cookie-stealing script. When a second authenticated user - for example, another administrator - loads the home page in their browser, the injected script executes and exfiltrates their session token. The attack is operationally equivalent to other code execution paths the admin role already provides, offering no net new capability.