PT-2025-51240 · Grav · Grav

Yohane-Mashiro · Published 2025-12-15 · Updated 2025-12-17 · CVE-2025-66843

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions grav versions prior to 1.7.49.5

Description The software contains a Stored Cross-Site Scripting issue within the page editing functionality. An authenticated, low-privileged user who has permission to edit content can inject malicious JavaScript payloads into editable fields. This payload is stored on the server and executed when another user views or edits the affected page.

Recommendations Update to version 1.7.49.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66843

GHSA-MH85-44C2-3M97

Affected Products

Grav

References · 7

• 🔥 https://github.com/Yohane-Mashiro/grav_cve/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-66843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66843 · Security Note
• https://twitter.com/CVEnew/status/2000611251618193731 · Twitter Post
• https://t.me/cveNotify/146100 · Telegram Post
• https://t.me/CVEtracker/39850 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000668989391806782 · Twitter Post