Grav CMS EUVD-2026-60592

Requires an authenticated Grav account with page-editing (editor/author) privileges - this is the core limiting factor (PR:L); anonymous internet users cannot exploit it directly. The specific technical prerequisite is crafting an HTML attribute as an unquoted value containing an unpaired quote so that an event handler such as onerror= evades the detectXss() check. Exploitation also needs victim interaction (UI:P): the payload only fires when someone renders the affected page in a browser. It applies to default configurations of Grav prior to 2.0.15 - no unusual feature toggle is needed beyond having the vulnerable version and at least one editor account whose trust you cannot fully guarantee.

The signals are mostly consistent and point to a genuine high priority within the population that runs Grav. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H) scores 9.3 and reflects a network-reachable, low-complexity attack requiring only a low-privileged authenticated editor account plus passive victim interaction (a visitor viewing the page). The elevating factor is that impact crosses a trust boundary - code chosen by an editor runs in every visitor's session - so an operator running a multi-author Grav site should treat this as urgent even though it is not remote-unauthenticated. The tempering factors are real: exploitation requires an editor-level account (PR:L), so this is primarily an insider or account-compromise vector rather than a mass-scannable internet threat, and there is no public exploit code and no CISA KEV listing, so widespread opportunistic exploitation is not currently evidenced. EPSS was not provided in the input and cannot be cited. Net: credible and worth prompt patching wherever untrusted or numerous editors exist, but the PR:L requirement meaningfully narrows the realistic attacker set compared to a raw 9.3 read.

An attacker with (or who has phished/compromised) a low-privileged Grav editor account edits a page and inserts an HTML tag whose unquoted attribute value uses an unpaired quote to hide an onerror= handler, which passes detectXss() and is saved. When a normal site visitor or an administrator later views the page, the handler executes in their browser, allowing session-cookie theft, actions performed as the victim, or admin-account takeover. No public proof-of-concept exploit was identified at time of analysis.