Is CVE-2026-55890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55890 being exploited in the wild.

How severe is CVE-2026-55890?

Medium severity, with a CVSS score of 4.8, published 10 July 2026.

Which products and versions are affected?

Grav < 2.0.0-rc.9, <= 2.0.0-rc.8; getgrav/grav (Packagist) <= 2.0.0-rc.8, ECOSYSTEM:introduced=0,fixed=2.0.0-rc.9.

Is there a fix for CVE-2026-55890?

Yes. getgrav/grav (Packagist): upgrade to 2.0.0-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55890 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55890?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55890: Grav stored CSS injection in Markdown image style attribute

Q: Which products and versions are affected?

Grav < 2.0.0-rc.9, <= 2.0.0-rc.8; getgrav/grav (Packagist) <= 2.0.0-rc.8, ECOSYSTEM:introduced=0,fixed=2.0.0-rc.9.

Q: Is there a fix for CVE-2026-55890?

Yes. getgrav/grav (Packagist): upgrade to 2.0.0-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55890 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55890?

Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55890 · Severity: medium · CVSS 4.8 · Published 2026-07-10

Grav, a file-based web platform, is vulnerable to a security flaw where users with page-editing permissions can inject malicious CSS code into images. This could allow an attacker to create fake login overlays (phishing), hijack clicks, or disrupt the administrative interface for other users, including site administrators. The issue stems from an incomplete previous security fix and has been resolved in version 2.0.0-rc.9.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-55890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55890 being exploited in the wild.
How severe is CVE-2026-55890?: Medium severity, with a CVSS score of 4.8, published 10 July 2026.
Which products and versions are affected?: Grav < 2.0.0-rc.9, <= 2.0.0-rc.8; getgrav/grav (Packagist) <= 2.0.0-rc.8, ECOSYSTEM:introduced=0,fixed=2.0.0-rc.9.
Is there a fix for CVE-2026-55890?: Yes. getgrav/grav (Packagist): upgrade to 2.0.0-rc.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55890 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55890?: Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 2.0.0-rc.9 or later
```
composer require getgrav/grav:^2.0.0-rc.9
```

Technical details

An incomplete fix for CVE-2026-42841 in Grav left the MediaObjectTrait::style() method unsanitized while the sibling attribute() method was patched. The Markdown excerpt-action pipeline allows an editor to pass arbitrary strings via the '?style=' query parameter in image Markdown (e.g., ![alt](img.png?style=...)). These strings are written directly into the rendered HTML <img> tag's style attribute. While htmlspecialchars() prevents attribute breakout, an attacker with page-editing permissions can inject malicious CSS to perform UI redress, phishing via fixed-position overlays, or CSS-based data exfiltration against higher-privileged users. The vulnerability is fixed in version 2.0.0-rc.9 by implementing a fail-closed validation for CSS properties and values.

Affected products

getgrav Grav < 2.0.0-rc.9

Identifiers

CVE-2026-55890
GHSA-pmf8-g7c8-7v54

Timeline

2026-06-16: patched: Fix committed to repository and version 2.0.0-rc.9 released.
2026-07-10: disclosed: CVE-2026-55890 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.