Executive brief
Grav, a file-based web platform, is vulnerable to a security flaw where users with page-editing permissions can inject malicious CSS code into images. This could allow an attacker to create fake login overlays (phishing), hijack clicks, or disrupt the administrative interface for other users, including site administrators. The issue stems from an incomplete previous security fix and has been resolved in version 2.0.0-rc.9.
Technical details
An incomplete fix for CVE-2026-42841 in Grav left the MediaObjectTrait::style() method unsanitized while the sibling attribute() method was patched. The Markdown excerpt-action pipeline allows an editor to pass arbitrary strings via the '?style=' query parameter in image Markdown (e.g., ). These strings are written directly into the rendered HTML <img> tag's style attribute. While htmlspecialchars() prevents attribute breakout, an attacker with page-editing permissions can inject malicious CSS to perform UI redress, phishing via fixed-position overlays, or CSS-based data exfiltration against higher-privileged users. The vulnerability is fixed in version 2.0.0-rc.9 by implementing a fail-closed validation for CSS properties and values.
Affected products
- getgrav Grav < 2.0.0-rc.9
Timeline
- 2026-06-16: patched: Fix committed to repository and version 2.0.0-rc.9 released.
- 2026-07-10: disclosed: CVE-2026-55890 published.