Description
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.
Published: 2026-06-18
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is stored cross‑site scripting (XSS) (CWE‑79) in the Grav Admin2 Pages API save flow. The missing safety check allows malicious content to be persisted in a page through the Admin2 Pages API save flow.

Affected Systems

The vulnerability affects Grav versions 2.0.0‑rc.9 and their Admin2 component 2.0.0‑rc.14, specifically the Grav Plugin API 1.7.52. Any Grav site that uses these releases and allows page editing through the Admin2 interface is potentially susceptible.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no currently documented exploits. Based on the description, it is inferred that an attacker with access to the Admin2 API, such as an authenticated administrator or content editor, could inject malicious content that would be stored and rendered on subsequent page views.

Generated by OpenCVE AI on June 18, 2026 at 18:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Grav Plugin API to a version that includes the upstream fix identified by commit b8ca62eddb7dbea92075a78b1c0a507f03d66d4a
  • Remove or sanitize any pages or content that may contain injected scripts to prevent accidental execution
  • If upgrading is not immediately possible, restrict page editing privileges to trusted users or disable the vulnerable API endpoint until a patch is applied

Generated by OpenCVE AI on June 18, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 18 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 18 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.
Title Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
First Time appeared Grav
Grav grav-plugin-api
Weaknesses CWE-79
CPEs cpe:2.3:a:grav:grav-plugin-api:1.7.52:*:linux:*:*:*:*:*
cpe:2.3:a:grav:grav-plugin-api:1.7.52:*:macos:*:*:*:*:*
cpe:2.3:a:grav:grav-plugin-api:1.7.52:*:windows:*:*:*:*:*
Vendors & Products Grav
Grav grav-plugin-api
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Grav Grav-plugin-api
cve-icon MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published:

Updated: 2026-06-18T17:26:30.765Z

Reserved: 2026-06-11T13:52:36.366Z

Link: CVE-2026-11982

cve-icon Vulnrichment

Updated: 2026-06-18T17:26:26.052Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T20:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')