PT-2026-37277 · Grav · Grav

Khanmarshai · Published 2026-05-05 · Updated 2026-05-27 · CVE-2026-42611

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2

Description A low-privileged user with page creation permissions can perform stored Cross-Site Scripting (XSS) by injecting an svg element. This occurs because the XSS filter in the detectXss() function uses a regular expression for on events that fails to detect unquoted event handlers. The issue is located in the system/src/Grav/Common/Security.php file and affects the 'admin/pages/' endpoint.

This XSS can be escalated to exfiltrate sensitive system information from the '/admin/config/info' endpoint when visited by a Super Admin. An attacker can capture the admin nonce, which may be used to bypass CSRF protections and potentially lead to Remote Code Execution (RCE) and full server compromise.

Recommendations Update to version 2.0.0-beta.2 or later. As a temporary workaround, restrict the ability of low-privileged users to create or edit pages until the update is applied.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42611

GHSA-W8CG-7JCJ-4VV2

Affected Products

Grav

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2 · Exploit
• https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42611 · Security Note
• https://osv.dev/vulnerability/GHSA-w8cg-7jcj-4vv2 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://twitter.com/VulmonFeeds/status/2053936114390438106 · Twitter Post
• https://twitter.com/CVEnew/status/2053932466214522964 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2059435743248830527 · Twitter Post