PT-2026-61928 · Getgrav · Grav

Leonkaya + 1 · CVE-2026-64628 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-64628

Produtos afetados

Grav

Referências · 3

• https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph · Aviso do Fabricante
• https://vulncheck.com/advisories/grav-stored-cross-site-scripting-via-shortcode-attribute-handlers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64628 · Nota de Segurança