Junglewise Threat Intelligence

Grav stored CSS injection in Markdown image resize

Severity: medium · CVSS 4.8 · Published 2026-07-08

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Executive brief

Grav is a popular flat-file CMS used to build websites without a database. The vulnerability allows a content editor with limited permissions to inject malicious CSS code into page images through Markdown syntax. When an administrator or reviewer views the compromised page, the injected CSS executes in their browser, potentially showing deceptive overlays or manipulating page content—without any JavaScript needed. This crosses a trust boundary from lower to higher-privileged users.

Technical details

The vulnerability is a stored CSS injection in the Markdown image resize() media action within Grav's Excerpts::processMediaActions() and StaticResizeTrait::resize() methods. The resize() function writes caller-controlled width and height values directly into styleAttributes without validation, then serializes them as raw CSS. An attacker with page-edit permissions can craft an image URL like `image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200` to inject arbitrary CSS declarations. Prior hardening rejected direct ?style= and attribute() payloads, but this bypass was specific to the adjacent resize() path. The injected CSS renders in the final <img style=...> attribute when a higher-privileged user views or previews the page, enabling UI redress attacks (e.g., full-viewport overlays) and content manipulation. Patches are available in Grav 2.0.0 and later.

Affected products

  • Grav Grav before 2.0.0, including 2.0.0-rc.9 and 2.0 branch

Timeline

  • 2026-06-22: disclosed: GHSA-ffmg-hfvg-jhg9 published by Grav maintainers
  • 2026-06-22: patched: Fixed in Grav 2.0.0
  • 2026-07-08: advisory: GHSA-4wj4-79rr-pvff published to GitHub Advisory Database
  • 2026-09-16: other: GHSA-4wj4-79rr-pvff withdrawn as duplicate of GHSA-ffmg-hfvg-jhg9

References

Related threats