Security readout for executives and security teams
Plain-English summary
A logged-in Grav editor can save malicious page content that runs in visitors’ browsers. This could expose visitor data, alter displayed content, or abuse a visitor’s trusted session. The issue affects Grav versions before 2.0.15 and requires prompt remediation, especially where editor accounts are broadly assigned or could be compromised.
Executive priority
Treat as an urgent remediation item for public-facing Grav sites. Prioritize version verification immediately, then upgrade affected systems and review privileged editor activity. The business risk is significant because a compromised editor account could turn trusted website content into a persistent browser-based attack against visitors.
Technical view
Grav’s detectXss() validation can miss event-handler attributes when unpaired quotes appear in unquoted attribute values. An authenticated editor can therefore store content that triggers cross-site scripting when a visitor renders the affected page. The CVSS 4.0 score is 9.3, reflecting network reachability and high confidentiality and integrity impact across vulnerable and subsequent systems.
Likely exposure
Exposure is highest for internet-facing Grav sites running a version before 2.0.15 where untrusted, compromised, or excessive-privilege accounts can edit content. Exploitation requires authenticated editor privileges and a visitor to view the stored content. Sites without affected Grav versions are not indicated as vulnerable by the supplied sources.
Exploitation context
The supplied record is not listed in KEV and provides no evidence of active exploitation. Exploitation requires low privileges and visitor interaction, but stored content can repeatedly affect visitors until removed. The recent publication date and critical score justify rapid action without treating exploitation as confirmed.
Researcher notes
CWE-79 applies. The flaw is a validation bypass in detectXss(), specifically involving unpaired quotes within unquoted attribute values and missed event-handler detection. The supplied CVSS vector indicates no availability impact but high confidentiality and integrity impacts. The bundle identifies versions before 2.0.15; no broader product scope or exploitation evidence should be inferred.
Mitigation direction
- Upgrade affected Grav installations to version 2.0.15 or later.
- Restrict content-editing privileges to trusted, necessary accounts.
- Review editor accounts for compromise or unnecessary access.
- Inspect existing page content for suspicious event-handler attributes.
- Consult the Grav vendor advisory for any additional remediation guidance.
Validation and detection
- Inventory Grav installations and confirm their deployed versions.
- Verify no production instance runs a version before 2.0.15.
- Review recently modified content and editor activity for anomalies.
- Confirm privileged editor accounts use appropriate access controls.
- After upgrading, verify normal content rendering and editing behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-75828 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N2.35.8VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Base CVSS 3.1 score
8.7HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-vfmf-q6x9-cw96)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: Grav before 2.0.15 Stored XSS via detectXss() Quote BypassCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.