Stored Cross-Site Scripting Vulnerability in Grav Media Rendering by Grav Technologies

CVE-2026-75831

What is CVE-2026-75831?

Grav versions prior to 2.0.15 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises from improper handling of media URLs during the rendering process via the sourceParsedownElement method. Specifically, the media URL fragment is concatenated into raw HTML source elements without being properly escaped. This oversight allows malicious users to inject arbitrary HTML and JavaScript, which can then execute within the session of any user viewing the affected media. As a result, unauthorized actions or data theft may occur, posing significant risks to the application's security.

References