Cross Site Scripting Vulnerability in Grav CMS by GetGrav
CVE-2025-65186

6.1MEDIUM

Key Information:

Vendor

GetGrav

Status
Grav CMS
Vendor
CVE Published:
2 December 2025

What is CVE-2025-65186?

Grav CMS version 1.7.49 has a vulnerability that allows Cross Site Scripting (XSS) attacks through its markdown content editor. This flaw originates from the editor's failure to adequately sanitize tags inputted by authenticated users. As a result, malicious scripts can be stored and executed whenever the edited pages are viewed in the admin interface, posing a significant security risk to the application's integrity and user data.

References

https://github.com/getgrav/grav
https://github.com/lukehebe/Vulnerability-Disclosures/blo...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.