Grav CMS EUVD-2026-58646

Exploitation requires an account with Grav page-editor privileges; the account must NOT hold admin.super (full administrator) rights, making this accessible to broadly-delegated editor roles. The attacker must be able to save and publish a page visible to other users. Victim interaction is limited to loading the affected page in a standard browser with JavaScript enabled - no special browser configuration, plugin, or user action beyond page navigation is required. Limiting factors: (1) the attacker must already possess a valid page-editor credential; (2) the site must delegate page-editing access to accounts that are not fully trusted; (3) JavaScript must be enabled in the victim's browser (default in virtually all browsers); (4) impact is scoped to the site origin - no cross-origin privilege escalation is enabled by this flaw. No non-default Grav configuration is required; the vulnerability exists in the default page-save code path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) accurately captures the principal limiting factors: the attacker must hold a page-editor credential (PR:L) and a victim must view the page (UI:P). Despite the moderate score, the stored nature of this XSS substantially raises real-world impact compared with reflected variants, because a single injected payload persists and fires for every subsequent visitor without further attacker interaction. No EPSS score was included in the available intelligence, so statistical exploitation probability cannot be quantified from provided data. The vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis. The realistic threat actor is a semi-trusted but malicious or compromised editor account - a scenario common in multi-author CMS deployments where page-editing access is broadly delegated. No conflicting signals were identified between the CVSS 4.0 vector and the vulnerability description; the metrics and the technical narrative are consistent.

An attacker who holds a Grav page-editor account (without admin.super) edits a publicly accessible page and saves content containing <img src=x title=">" onerror=alert(document.domain)>. The flawed regex in Security::detectXss() encounters the > inside the title attribute and incorrectly treats the tag as closed, passing the payload as safe and storing it in the CMS. Every subsequent visitor to that page - including unauthenticated users - has the onerror handler execute in the site origin, enabling session-cookie theft, CSRF-equivalent actions, or user redirection to attacker-controlled pages.