CVE-2025-46198
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-08-20
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getgrav | grav | to 1.8.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-46198 is a Cross Site Scripting (XSS) vulnerability in Grav CMS versions 1.7.46 through 1.7.48. It allows authenticated attackers with editor or publishing permissions to inject malicious code via the onerror attribute of an img element. This bypasses standard script tag filtering and enables arbitrary code execution within the CMS. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary code within the Grav CMS environment, potentially leading to unauthorized actions such as data theft, defacement, or further compromise of the system. Since it requires authenticated access with editor or publishing permissions, attackers who gain such access can exploit this flaw to manipulate site content or perform malicious activities. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unauthorized or suspicious content injection in Grav CMS pages, especially looking for img elements with onerror attributes containing JavaScript code. Since the vulnerability is exploited via the /admin interface by authenticated users with editor or publishing permissions, reviewing recent page edits for such payloads is recommended. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting editor and publishing permissions to trusted users only, reviewing and sanitizing content edits to prevent injection of img elements with malicious onerror attributes, and applying any available patches or updates from Grav CMS that address this vulnerability. [1]