CVE-2026-85598
Last modified
CVE-2026-85598 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions..
Description
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| getgrav | grav | >= 2.0.0, <= 2.0.17 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-85598?
How severe is CVE-2026-85598?
How do I fix CVE-2026-85598?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-85592phpMyFAQ before 4.1.8 contains an authorization bypass vulne…3.7
- CVE-2026-85593phpMyFAQ versions before 4.1.8 contain a stored cross-site s…5.4
- CVE-2026-85594Traefik versions from v3.7.1 fail to enforce crossProviderNa…7
- CVE-2026-85595Traefik versions before v2.11.55 and versions v3.0.0 through…9.3
- CVE-2026-85596Traefik versions >= v3.7.0 and <= v3.7.10 contain an authent…8.2
- CVE-2026-85597Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a…8.2
- CVE-2026-85599Grav Shortcode Core before 6.2.5 contains stored cross-site …7.2
- CVE-2026-8560Heap buffer overflow in SwiftShader in Google Chrome on Mac …4.3
- CVE-2026-85600Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 c…5.4
- CVE-2026-85601Grav Admin before 2.0.20 fails to sanitize output from marke…5.4
- CVE-2026-85602The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0…5.3
- CVE-2026-85603Grav versions before 1.10.55 contain a path traversal vulner…6.5
Are you affected by CVE-2026-85598?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST