Stored XSS in Grav CMS via Unsanitized Markdown Image Styles

Executive Summary

CVE-2026-55890 is a stored CSS injection vulnerability in the Grav CMS platform affecting versions 2.0.0-rc.8 and earlier. It arises from an incomplete fix for a previous vulnerability where the MediaObjectTrait::style() method allowed editors to inject unsanitized CSS styles into Markdown image syntax. This means an attacker with editor privileges can save malicious CSS in image style parameters that get rendered directly into the img style attribute without proper filtering.

The vulnerability allows injection of dangerous CSS properties such as positioning and stacking (e.g., position, z-index), function calls like url() or expression(), and other potentially harmful constructs. This can lead to attacks like phishing overlays, clickjacking, UI denial-of-service, or CSS-based data exfiltration.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with editor-level permissions to inject malicious CSS into images displayed on the website. This CSS can be used to create phishing overlays, perform clickjacking attacks, cause user interface denial-of-service by disrupting page layout, or exfiltrate data through CSS-based techniques.

Because the injected styles affect all users viewing the page, including administrators, the impact extends beyond the attacker's own privileges, potentially compromising the security and integrity of the website and its users.

The vulnerability requires high privileges (editor role) and some user interaction (viewing the affected page), and has a moderate CVSS score of 4.8.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious CSS injected via the Markdown image style parameter (?style=) in Grav CMS, which is stored and rendered in the img style attribute without sanitization.

Detection involves identifying Markdown image syntax using the ?style= parameter that contains potentially dangerous CSS properties such as positioning (e.g., position:fixed), stacking (z-index), or function calls like url() or expression().

Since the vulnerability bypasses typical XSS detection, manual inspection or custom scripts to scan stored Markdown content or rendered HTML for suspicious inline styles is recommended.

• Search your Grav content files for Markdown image links with the ?style= parameter, for example using grep:
• grep -r '\!\[.*\](.*\?style=.*)' /path/to/grav/user/pages
• Inspect rendered HTML pages for img tags with suspicious style attributes, for example using curl and grep:
• curl -s http://yourgravsite | grep '<img ' | grep 'style='

These commands help identify potentially malicious inline styles injected via Markdown images that exploit this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Grav CMS to version 2.0.0-rc.9 or later, where the vulnerability is fixed by introducing strict validation of inline image styles.

If immediate upgrade is not possible, consider disabling or restricting editor permissions (admin.pages) to prevent untrusted users from injecting Markdown image styles.

Alternatively, remove or sanitize existing Markdown content that uses the ?style= parameter to prevent malicious CSS from being rendered.

The fix involves applying a denylist and validation function (`isSafeStyleValue()`) that blocks dangerous CSS properties (e.g., position, z-index), function calls (url(), expression()), at-rules, and markup characters.

Deprecating or disabling the Markdown ?style= feature entirely is also suggested to eliminate this attack vector.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with editor privileges to inject malicious CSS into rendered images, which can be used for phishing overlays, clickjacking, UI denial-of-service, or CSS-based data exfiltration.

Such attacks could potentially lead to unauthorized access or exposure of sensitive information, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive data.

However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these standards or regulations.

Useful 0 Not Useful 0