CVE-2026-42611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42611", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-29T00:31:15.726Z", "datePublished": "2026-05-11T15:20:47.890Z", "dateUpdated": "2026-05-11T18:23:59.282Z"}, "containers": {"cna": {"title": "Grav: Stored XSS via Tag Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2"}, {"name": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "tags": ["x_refsource_MISC"], "url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663"}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"version": "< 2.0.0-beta.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T15:20:47.890Z"}, "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2."}], "source": {"advisory": "GHSA-w8cg-7jcj-4vv2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T18:23:37.346111Z", "id": "CVE-2026-42611", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:23:59.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42611", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:23:37.346111Z"}}}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:23:55.414Z"}}], "cna": {"title": "Grav: Stored XSS via Tag Injection", "source": {"advisory": "GHSA-w8cg-7jcj-4vv2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}], "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "name": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "name": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T15:20:47.890Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42611", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:23:59.282Z", "dateReserved": "2026-04-29T00:31:15.726Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T15:20:47.890Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grav", "vendor": "getgrav", "versions": [{"status": "affected", "version": "< 2.0.0-beta.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C284702-7909-4A5C-91FE-392FC5BA58C7", "versionEndIncluding": "1.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "1ABB323F-20AF-40F3-BCD9-262644D242A1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la versi\u00f3n 2.0.0-beta.2, un usuario con bajos privilegios (con la capacidad de crear una p\u00e1gina) puede causar XSS con la inyecci\u00f3n de un elemento SVG. El XSS puede escalarse a\u00fan m\u00e1s para volcar toda la informaci\u00f3n del sistema disponible en /admin/config/info cada vez que un Super Administrador visita la p\u00e1gina; lo que puede encadenarse a\u00fan m\u00e1s con el uso de admin-nonce para lograr un compromiso completo del servidor (RCE). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.0.0-beta.2."}], "id": "CVE-2026-42611", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42611", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T18:23:37.346111Z", "version": "2.0.3"}}]}, "published": "2026-05-11T16:17:34.173", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0-beta.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grav", "source": "cna", "vendor": "getgrav"}, "product": "grav", "vendor": "getgrav"}], "created": "2026-05-11T17:00:15.773365+00:00", "updated": "2026-05-11T17:15:39.754579+00:00", "vendors": ["getgrav", "getgrav$PRODUCT$grav"]}