CVE-2025-66843
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getgrav | grav | to 1.7.49.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-66843 is a Stored Cross-Site Scripting (Stored XSS) vulnerability in Grav CMS before version 1.7.49.5. An authenticated user with low privileges who can edit content can inject malicious JavaScript code into editable fields on a page. This malicious code is stored on the server and later executed in the browsers of any users who view or edit the affected page. The vulnerability exists because the application does not properly sanitize or escape user-supplied HTML content during page editing, allowing attackers to insert harmful scripts that run in other users' browser sessions. [1]
How can this vulnerability impact me? :
This vulnerability can lead to several serious impacts including session hijacking, theft of cookies, extraction of CSRF tokens, and execution of arbitrary JavaScript code as another user. If an administrator views the infected page, the attacker could perform unauthorized administrative actions. Additionally, it can be used for defacement or phishing attacks by injecting malicious scripts. Exploitation does not require any privileges beyond the ability to edit page content. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying pages edited by low-privileged users that contain suspicious HTML elements with JavaScript event handlers. You can search the Grav CMS content files for injected payload patterns such as '<svg onload=', '<img src=x onerror=', or similar event attributes. For example, use grep commands on the Grav pages directory to find these patterns: grep -r -E '<svg onload=|<img src=x onerror=|<video src=x onerror=' user/pages/. This helps locate stored malicious scripts injected via page editing. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting page editing permissions to trusted users only, reviewing and cleaning existing content for injected malicious scripts, and applying input sanitization or escaping on user-supplied HTML content during page editing. Additionally, updating Grav CMS to a version later than v1.7.49.5 once a patch is available is recommended to fix the vulnerability at the application level. [1]