CVE-2026-85598 - Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

Back Back to CVE browser

MEDIUM

Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

Published Sep 4, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.26%

Description

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.

Affected products

Vendor Getgrav Product Grav Default
unaffected
- Version
  2.0.0
  Status
  affected
  Constraints
  <=2.0.17

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Getgrav

Grav

unaffected

Version	Status	Constraints
2.0.0	affected	<=2.0.17

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71021
Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-fg8g-663r-f366
vendor-advisory
https://www.vulncheck.com/advisories/grav-2.0.0-through-2.0.17-stored-xss-via-modular-pages
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-71021		Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-fg8g-663r-f366		vendor-advisory
https://www.vulncheck.com/advisories/grav-2.0.0-through-2.0.17-stored-xss-via-modular-pages		third-party-advisory