CVE-2026-42611: Grav stored XSS via SVG tag injection in Admin Plugin

CVE-2026-42611 · Severity: high · CVSS 8.9 · Published 2026-05-11

A vulnerability in the Grav content management system allows a user with basic page-creation permissions to inject malicious scripts into the website. When an administrator views the affected page, the script can steal sensitive session information and system configuration details. This can be used by an attacker to take full control of the web server and execute unauthorized commands.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42611 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42611 being exploited in the wild.
How severe is CVE-2026-42611?
High severity, with a CVSS score of 8.9, published 11 May 2026.
Which products and versions are affected?
Grav < 2.0.0-beta.2; getgrav/grav (Packagist) < 2.0.0-beta.2, ECOSYSTEM:introduced=0,fixed=2.0.0-beta.2.
Is there a fix for CVE-2026-42611?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42611 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-42611?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Grav Core and the Admin Plugin due to insufficient sanitization in the `detectXss` method within `system/src/Grav/Common/Security.php`. The vulnerability stems from a flawed regular expression used to detect event handlers (`on_events`), which can be bypassed using unquoted attributes (e.g., `<img src=x onload=... >`). Additionally, the default security configuration failed to blacklist dangerous tags like `<svg>` and `<math>`. A low-privileged user with page creation rights can inject these tags to execute arbitrary JavaScript in an administrator's browser. This can be used to exfiltrate the `admin_nonce`, enabling CSRF bypass and subsequent Remote Code Execution (RCE) via administrative endpoints. The issue is addressed in version 2.0.0-beta.2 by tightening the regex and expanding the `security.xss_dangerous_tags` list.

Affected products

  • getgrav Grav < 2.0.0-beta.2

Identifiers

  • CVE-2026-42611
  • GHSA-w8cg-7jcj-4vv2

Timeline

  • 2026-04-24: patched: Fix applied to Grav core 2.0 branch.
  • 2026-05-05: advisory: Public disclosure of GHSA-w8cg-7jcj-4vv2.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.