Executive brief
Grav is a flat-file content management system used to build websites without a database. A vulnerability in its Markdown renderer allows attackers to inject malicious JavaScript into audio or video embeds that executes when any user (including administrators) views the page, potentially exposing admin sessions and enabling account takeover.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the AudioMediaTrait and VideoMediaTrait classes' sourceParsedownElement() method. The vulnerability arises because media URLs—including their URL fragments—are concatenated directly into unescaped rawHtml source elements without proper encoding. An attacker can craft a malicious Markdown embed like ![x](song.mp3#"><svg/onload=alert(1)>) to break out of the src attribute and inject arbitrary HTML and JavaScript. The root cause is that while the querystring path is filtered by GFM tagfilter, the URL fragment bypasses these defenses because htmlspecialchars_decode(urldecode(...)) in the excerpt handler undoes Parsedown's escaping. An attacker requires low privileges (ability to create or edit Markdown content) and user interaction (a victim must view the malicious page), but the impact is high—any viewer's JavaScript executes in the same origin, and administrators' sessions are exposed. Grav patched this in version 2.0.15.
Affected products
- Getgrav Grav < 2.0.15
Timeline
- 2026-08-03: disclosed: Original vulnerability (GHSA-6qw9-4vv5-jr97) disclosed by maintainer
- 2026: patched: Patched in version 2.0.15
- 2026-08-18: advisory: Duplicate advisory GHSA-q8cg-5m48-5c25 published
- 2026-09-17: other: Duplicate advisory withdrawn, consolidated into GHSA-6qw9-4vv5-jr97