Read the docs
TI-2020-19390 Aliases CVE-2020-37256GHSA-gwrh-r2g6-7wgp

Grav - Cross-Site Scripting in Admin Plugin Page Editor

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Fix Fixed Grav (Grav): 1.6.30

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GravGravbefore 1.6.301.6.30Patch availableCNA
  • Grav VendorGrav Affected before 1.6.30 Fixed in 1.6.30 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*before 1.6.30Vulnerablegetgrav
  • cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* Versions before 1.6.30 Vulnerable ·getgrav

Remediation

  • Fix · CNA Grav (Grav) Fixed in 1.6.30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-37256
  2. 2026-10-03 Alias added: GHSA-gwrh-r2g6-7wgp

References

Advisory 1

  • TI-2026-40880 Grav - XML External Entity Injection via SVG Upload CVSS 4.0HIGH 7.1
  • TI-2026-42219 Grav - Arbitrary File Upload via Avatar Endpoint CVSS 4.0MEDIUM 5.3
  • TI-2026-10325 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CVSS 4.0MEDIUM 5.1
  • TI-2026-42222 Grav - Stored CSS Injection via Markdown Image resize() Action CVSS 4.0MEDIUM 4.8
  • TI-2026-40879 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-06424 Grav CMS Cache Value FileCache.php doGet deserialization CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences