CVE-2026-75831CWE-79cross-site-scripting

CVE-2026-75831

High · published August 18, 2026

CVSS v3.1

7.6

EPSS

Percentile

27.4

In the wild

Unconfirmed

What it is

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.

The record

Technical detail

CVSS v3.1: 7.6 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0: 5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00350 · 27.4th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-08-18T16:19Z

References (4)

https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20 · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97 · [email protected]https://www.vulncheck.com/advisories/grav-before-stored-xss-via-audio-video-source-url · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

18 AUG 11:19Z
Grav before 2.0.15 Stored XSS via audio/video source URL
cvelistv5