DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75831: CVE-2026-75831: Stored Cross-Site Scripting in Grav CMS Audio/Video Media Rendering

#security #cve #cybersecurity

CVE-2026-75831: Stored Cross-Site Scripting in Grav CMS Audio/Video Media Rendering

Vulnerability ID: CVE-2026-75831
CVSS Score: 7.6
Published: 2026-09-17

Improper neutralization of input during web page generation in Grav CMS allows authenticated users with page modification privileges to execute stored Cross-Site Scripting (XSS) attacks. The flaw exists in AudioMediaTrait and VideoMediaTrait where media source URLs are concatenated directly into HTML templates without proper escaping.

TL;DR

A stored Cross-Site Scripting vulnerability in Grav CMS versions prior to 2.0.15 allows authenticated editors to insert arbitrary JavaScript via malicious audio/video file paths, which executes in the context of any user (including administrators) viewing the page.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.6 (High)
  • EPSS Score: 0.00313 (0.31%)
  • Impact: Stored Cross-Site Scripting (XSS)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Grav CMS
  • Grav: < 2.0.15 (Fixed in: 2.0.15)

Code Analysis

Commit: d5f89d9

Escape the URL before it lands in the rawHtml source string to prevent Stored XSS (GHSA-6qw9-4vv5-jr97)

Exploit Details

Mitigation Strategies

  • Upgrade Grav CMS core to version 2.0.15 or later.
  • Deploy a robust Content Security Policy (CSP) to block unauthenticated inline scripts.
  • Utilize WAF rules to detect and drop payloads containing attribute breakout characters in markdown submissions.

Remediation Steps:

  1. Navigate to the Grav Admin Panel.
  2. Select the update notification or run 'bin/gpm self-upgrade' via the command line interface.
  3. Verify that 'AudioMediaTrait.php' and 'VideoMediaTrait.php' contain the htmlspecialchars wrapping for the $location variable.
  4. Clear the Grav cache by executing 'bin/grav clear-cache'.

References

Read the full report for CVE-2026-75831 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)