PT-2026-37280 · Grav · Grav

K-Czaplicki + 1 · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-42841

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2

Description An authenticated user with page editing permissions can perform stored Cross-Site Scripting (XSS) by injecting an executable JavaScript event-handler attribute into rendered image HTML. This occurs because Markdown image query parameters are converted into callable media actions, allowing access to the public attribute() media method. An attacker can use this to set arbitrary HTML attribute names and values on generated image elements. For example, using a query parameter like attribute=onload,alert(document.domain) results in an <img> tag with an executable onload handler. In multi-user environments, a lower-privileged editor could target administrators or reviewers who view the affected content.

Recommendations Update Grav to version 2.0.0-beta.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42841

GHSA-R7FX-8G49-7HHR

Affected Products

Grav

References · 8

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr · Exploit
• https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42841 · Security Note
• https://osv.dev/vulnerability/GHSA-r7fx-8g49-7hhr · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://twitter.com/infoflowcloud/status/2053933438088978525 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053930995045343524 · Twitter Post
• https://twitter.com/CVEnew/status/2053932474909241761 · Twitter Post