CVE-2026-58657: Stored CSS Injection in Grav CMS Media Resize Parser
Vulnerability ID: CVE-2026-58657
CVSS Score: 6.5
Published: 2026-09-16
CVE-2026-58657 is a critical stored CSS injection vulnerability in Grav CMS's media processing pipeline. By exploiting improper sanitization of image dimensions in the resize helper, low-privileged users with page editing permissions can inject arbitrary CSS styles. This can lead to visual defacement, UI redressing, and indirect data exfiltration.
TL;DR
Low-privileged editors can inject arbitrary CSS via image resize query parameters due to missing type validation in Grav's media processing trait.
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network
- CVSS Score: 6.5
- EPSS Score: 0.00371
- Impact: Stored CSS Injection
- Exploit Status: none
- KEV Status: Not Listed
Affected Systems
- Grav CMS
-
Grav CMS: < 2.0.0 (Fixed in:
2.0.0)
Code Analysis
Commit: bb4022f
Fix/Hardening Implementation Commit in StaticResizeTrait
Commit: 6582166
Twig Modular Consistency Patch Reference
Mitigation Strategies
- Upgrade to Grav CMS version 2.0.0 or higher
- Manually apply integer casting patch to StaticResizeTrait.php
- Implement a restrictive Content Security Policy (CSP) for style-src
Remediation Steps:
- Identify all Grav CMS instances running versions prior to 2.0.0
- Deploy the Grav 2.0.0 update via the admin dashboard or package manager
- Verify the fix by testing image markdown processing with non-numeric resize parameters
- Audit active page content for existing malformed markdown image references
References
Read the full report for CVE-2026-58657 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)