The vulnerability is a stored cross‑site scripting flaw that allows a low‑privileged user to inject an SVG element containing malicious script into a page. When a high‑privileged Super Admin later views that page, the script can access system configuration data located at /admin/config/info. Because the information can be used together with the admin‑nonce mechanism, an attacker may ultimately achieve remote code execution. This flaw is mapped to CWE‑79.

Grav, the open‑source file‑based web content management system released by getgrav:grav, is affected in all releases older than 2.0.0‑beta.2. Users running those versions should audit their installation for untrusted page‑creation privileges.

The flaw carries a CVSS score of 8.9, indicating high severity. No EPSS data is available, but the absence of a KEV listing does not diminish the risk for active installations. Attackers can exploit the flaw simply by creating a new page with the injected SVG; the danger escalates only when a Super Admin subsequently visits the page. If an admin nonce can be co‑opted, the vulnerability provides a clear path to remote code execution. Given the high local impact and the availability of a fixed release, timely remediation is critical.