Stored XSS Vulnerability in Grav CMS by Grav Systems
CVE-2025-64059

1.8LOW

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
13 September 2026

What is CVE-2025-64059?

A vulnerability exists in Grav version 1.7.50.2 that permits administrators to inject JavaScript code through the Home Page editor. This may lead to stored cross-site scripting (XSS) risks, as the platform allows extensive template modifications, plugin installations, and the upload of executable content. It's essential to evaluate the implications of this vulnerability in the context of user permissions and template management.

Affected Version(s)

Grav 1.7.50.2

References

https://drive.google.com/file/d/1gbzdiaZEGTPwUPKLengVRO2N...

CVSS V3.1

Score:
1.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.