SB2026050589 - Multiple vulnerabilities in Grav CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026050589

SB2026050589 - Multiple vulnerabilities in Grav CMS

Published: May 5, 2026

Security Bulletin ID SB2026050589
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2025-66308)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in the /admin/config/site endpoint parameter data[taxonomies] when processing crafted site configuration input. A remote privileged user can submit a specially crafted POST request to execute arbitrary script in a user's browser.

User interaction is required for a user to access the affected configuration or related administrative interface where the stored payload is rendered.


2) Cross-site scripting (CVE-ID: CVE-2025-66309)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in the /admin/pages/[page] endpoint when handling the data[header][content][items] parameter. A remote privileged user can craft a malicious URL with a script payload to execute arbitrary script in the victim's browser.

User interaction is required when the crafted URL is accessed.


3) Cross-site scripting (CVE-ID: CVE-2025-66310)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in the /admin/pages/[page] endpoint parameter data[header][template] when handling crafted page update requests. A remote privileged user can submit a specially crafted value in the template field to execute arbitrary script in a user's browser.

User interaction is required for the affected content to be rendered, including in the administrative interface or frontend view.


4) Cross-site scripting (CVE-ID: CVE-2025-66311)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in the /admin/pages/[page] endpoint when processing page metadata and taxonomy parameters. A remote privileged user can submit a specially crafted POST request containing malicious script in data[header][metadata], data[header][taxonomy][category], or data[header][taxonomy][tag] to execute arbitrary script in a user's browser.

User interaction is required when the affected page is accessed or rendered in the administrative interface.


5) Cross-site scripting (CVE-ID: CVE-2025-66312)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the /admin/accounts/groups/[group] endpoint parameter data[readableName] when handling crafted group display name input. A remote privileged user can submit a specially crafted value to execute arbitrary script in a victim's browser.

User interaction is required when a user views the affected group configuration or opens a user profile page where the stored content is rendered.


Remediation

Install update from vendor's website.

References