Is there a patch available for EUVD-2026-37916?

Yes, a patch is available for EUVD-2026-37916. Update the affected software to the latest version immediately.

Grav Plugin API EUVD-2026-37916

Q: What is the CVSS score of EUVD-2026-37916?

EUVD-2026-37916 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-11982 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 Fluid Attacks

GHSA-pfvx-ccc8-f3hr

XSS Grav Grav Plugin Api

5.1

CVSS 4.0 · Vendor: Fluid Attacks

Severity by source

Vendor (Fluid Attacks) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Editor-level authentication required (PR:L), victim must load page (UI:R), stored payload persists across sessions with scope change (S:C), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Fluid Attacks).

CVSS VectorVendor: Fluid Attacks

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 18, 2026 - 17:12 vuln.today

Analysis Generated

Jun 18, 2026 - 17:12 vuln.today

DescriptionCVE.org

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.

AnalysisAI

Stored XSS in Grav CMS's grav-plugin-api (Admin2) allows a low-privileged editor to persist malicious JavaScript in page content via the PATCH /pages API endpoint, which then executes in any administrator's or visitor's browser when the affected page is loaded. The root cause is that the API's partial-field validation path (validateChangedFields()) ran only type and required-field checks but omitted the XSS safety gate (Validation::checkSafety()), a check the classic Admin interface correctly enforced - creating a trust-boundary bypass exclusive to the REST API path. Publicly available exploit code exists via the Fluid Attacks advisory and the vendor's own regression test suite; no active exploitation (CISA KEV) has been confirmed.

Technical ContextAI

Grav CMS is a flat-file PHP CMS; the affected component is grav-plugin-api (Admin2), identified by CPE cpe:2.3:a:grav:grav-plugin-api:*:*:*:*:*:*:*:*. The vulnerability resides in AbstractApiController::validateChangedFields() in classes/Api/Controllers/AbstractApiController.php, which handles partial-field delta submissions for HTTP PATCH requests to the /pages and /accounts endpoints. The classic Admin interface runs the full blueprint validator, which calls Validation::checkSafety() per field - invoking Security::detectXss() - before persisting content. The API path called only Validation::validate() for type and required checks, leaving the XSS safety gate entirely absent. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: unsanitized HTML event handlers such as onerror= attributes embedded in Markdown content fields (type: markdown, validated as textarea) were stored verbatim and later rendered in victim browsers. The fix adds Validation::checkSafety() calls within validateChangedFields() and honours the existing security.xss_whitelist (admin.super) and per-field xss_check: false blueprint settings, maintaining behavioural parity with the classic admin.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Apply patch commit b8ca62eddb7dbea92075a78b1c0a507f03d66d4a from https://github.com/getgrav/grav-plugin-api/commit/b8ca62eddb7dbea92075a78b1c0a507f03d66d4a, which adds Validation::checkSafety() to AbstractApiController::validateChangedFields() and closes the trust-boundary gap. Monitor https://github.com/getgrav/grav-plugin-api and the security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-5wc5-7v9g-f7v6 for a tagged release incorporating this fix. If immediate patching is not feasible, restrict API access to the PATCH /pages and PATCH /accounts endpoints to superadmin-level users only via network ACL or application-layer authentication controls, eliminating the attack surface for non-superadmin editors; the trade-off is that any automation or integrations relying on editor-level API writes will break. Alternatively, disable the grav-plugin-api plugin entirely if REST API access is not operationally required, accepting that all Admin2 API integrations will cease to function. Do not rely solely on a WAF-based XSS filter as a compensating control, as Markdown-context bypass payloads are well-documented and evasion is straightforward.