CVE-2026-42611

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663	Patch
https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2	Exploit Patch Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2	Exploit Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:getgrav:grav::::::::
	cpe:2.3:a:getgrav:grav:2.0.0:beta1::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Grav es una plataforma web basada en archivos. Antes de la versión 2.0.0-beta.2, un usuario con bajos privilegios (con la capacidad de crear una página) puede causar XSS con la inyección de un elemento SVG. El XSS puede escalarse aún más para volcar toda la información del sistema disponible en /admin/config/info cada vez que un Super Administrador visita la página; lo que puede encadenarse aún más con el uso de admin-nonce para lograr un compromiso completo del servidor (RCE). Esta vulnerabilidad está corregida en la versión 2.0.0-beta.2.

Information

Published : 2026-05-11 16:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42611

Mitre link : CVE-2026-42611

CVE.ORG link : CVE-2026-42611

JSON object : View

Products Affected

getgrav

grav

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-42611", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42611", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:23:37.346111Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}]}], "published": "2026-05-11T16:17:34.173", "references": [{"url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la versi\u00f3n 2.0.0-beta.2, un usuario con bajos privilegios (con la capacidad de crear una p\u00e1gina) puede causar XSS con la inyecci\u00f3n de un elemento SVG. El XSS puede escalarse a\u00fan m\u00e1s para volcar toda la informaci\u00f3n del sistema disponible en /admin/config/info cada vez que un Super Administrador visita la p\u00e1gina; lo que puede encadenarse a\u00fan m\u00e1s con el uso de admin-nonce para lograr un compromiso completo del servidor (RCE). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.0.0-beta.2."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C284702-7909-4A5C-91FE-392FC5BA58C7", "versionEndIncluding": "1.8.0"}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ABB323F-20AF-40F3-BCD9-262644D242A1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}