CVE-2026-75831 in Grav
Summary
by MITRE • 08/18/2026
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within Grav CMS versions prior to 2.0.15, specifically affecting the audio and video media rendering functionality. This vulnerability is classified as a stored cross-site scripting issue, which represents a severe category of web application insecurity where malicious scripts are permanently embedded within the content of a website or application rather than being transiently passed via URL parameters. The root cause lies in the sourceParsedownElement method, which processes markdown-formatted media links and converts them into HTML elements for browser rendering. During this conversion process, the system fails to properly sanitize or encode the media URL fragment before injecting it into the DOM structure of rawHtml source tags. This lack of input validation allows an attacker who has write access to content containing audio or video embeds to inject arbitrary JavaScript code that will be executed by any user viewing the affected page.
From a technical perspective, the vulnerability exploits the way modern web browsers parse HTML5 media elements such as <audio> and <video>. When Grav processes these elements, it constructs source tags with attributes derived from user-supplied input. Because the URL fragment is concatenated directly into the rawHtml output without escaping special characters like quotes or angle brackets, an attacker can craft a malicious payload that breaks out of the attribute context. For instance, by injecting a sequence such as "><script>alert(1)</script>, the browser interprets the closing tag and subsequent script injection as valid HTML syntax. This results in the immediate execution of the injected JavaScript within the security context of the victim's session. Since this is a stored vulnerability, the malicious code persists on the server side until the content is manually removed or updated, meaning every visitor to the page becomes a potential target without needing any direct interaction with the attacker beyond viewing the compromised media element.
The operational impact of this vulnerability extends significantly beyond simple script execution. An attacker leveraging this flaw can perform session hijacking by stealing authentication cookies and tokens stored in the browser local storage or cookie jars, thereby gaining unauthorized access to user accounts including administrative privileges if such users view the page. Furthermore, the ability to execute arbitrary JavaScript allows for keylogging, credential harvesting through fake login forms injected into the DOM, and redirection of victims to phishing sites designed to mimic legitimate Grav CMS interfaces. In enterprise environments where Grav is used as a content management system for internal portals or public-facing websites, this vulnerability can lead to widespread compromise of user data, reputational damage due to defacement, and potential lateral movement within the network if combined with other vulnerabilities such as server-side request forgery via JavaScript-based proxying techniques.
This flaw aligns closely with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under stored XSS where the malicious payload is saved on target servers and retrieved later when users access the affected content. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK T1059 Command and Scripting Interpreter through browser-based JavaScript execution, as well as T1078 Valid Accounts if used to steal credentials for persistent unauthorized access. The attack vector is primarily classified under Web Application Attack vectors where the attacker interacts directly with the application layer to inject malicious content that persists in the database or file system of the web server.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade Grav CMS to version 2.0.15 or later, as this release includes patches for input sanitization within the media rendering pipeline. For organizations unable to patch immediately due to compatibility constraints with custom plugins or themes, a temporary workaround involves implementing strict output encoding on all user-supplied data before it is rendered in HTML contexts. This can be achieved by configuring server-side web application firewalls to detect and block payloads containing common XSS indicators such as script tags, event handlers like onload or onclick, and javascript: URIs within media URL parameters. Additionally, developers should enforce Content Security Policy headers that restrict the execution of inline scripts and limit sources from which external resources can be loaded, thereby reducing the impact even if an injection attempt succeeds. Regular security audits focusing on markdown parsers and template engines are essential to prevent similar vulnerabilities in future updates or custom extensions developed for the platform.