CVE-2026-75831
Received Received - Intake

Stored XSS in Grav CMS Media Handling

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75831
EUVD
EUVD-2026-60595

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav to 2.0.15 (exc)
getgrav grav 2.0.14
grav grav to 2.0.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Grav CMS versions before 2.0.15. It occurs when malicious Markdown embeds are used with audio or video media URLs containing specially crafted fragments. The media URL fragment is improperly concatenated into raw HTML source elements without escaping, allowing attackers to inject arbitrary HTML and JavaScript that executes in users' sessions when they view the page.

Detection Guidance

Check Grav CMS version with 'composer show grav/grav' or 'bin/grav version'. Inspect media embeds in Markdown for audio/video URLs with fragments like 'resize=100;position:fixed;...' or malicious script tags. Review admin pages for unexpected HTML/JS in media players.

Impact Analysis

An attacker with page-edit rights could inject malicious scripts that execute in the context of any user viewing the page, including administrators. This could lead to session hijacking, unauthorized actions on behalf of the user, or exposure of sensitive data like Grav Admin session tokens. Users viewing compromised media may unknowingly execute attacker-controlled scripts.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, unauthorized data access, or loss of data integrity, potentially leading to regulatory penalties and compliance violations.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.15 or later immediately. Remove untrusted user-generated media embeds. Apply input validation for media URLs and fragments. Monitor for suspicious admin session activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart