TI-2026-42222 Aliases CVE-2026-58657 GHSA-ffmg-hfvg-jhg9

Grav - Stored CSS Injection via Markdown Image resize() Action

MEDIUM 55CWE-79Published 2026-07-08 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpts::processMediaActions() writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor who can edit page Markdown can store a crafted image URL with semicolon-delimited CSS declarations in the resize parameters, which are rendered into the final <img style=...> attribute when a higher-privileged reviewer/admin views the page or preview. This does not require JavaScript execution but enables UI redress/overlay and content-manipulation attacks (e.g., a full-viewport fixed overlay). Fixed in 2.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00267 18th percentileScored 2026-11-07

Fix Fixed Grav (Grav): 2.0.0getgrav/grav (Packagist): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Grav	Grav	2.0.0-rc.9 to before 2.0.0	2.0.0	Patch available	CNA
—	getgrav/grav (Packagist)	2.0.0-rc.9 to before 2.0.0	2.0.0	Patch available	GHSA-ffmg-hfvg-jhg9

Grav VendorGrav Affected 2.0.0-rc.9 to before 2.0.0 Fixed in 2.0.0 Patch available CNA
getgrav/grav (Packagist) Vendor— Affected 2.0.0-rc.9 to before 2.0.0 Fixed in 2.0.0 Patch available GHSA-ffmg-hfvg-jhg9

Remediation

Fix · CNA Grav (Grav) Fixed in 2.0.0
Fix · GHSA-ffmg-hfvg-jhg9 getgrav/grav (Packagist) Fixed in 2.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-58657
2026-10-03 Alias added: GHSA-ffmg-hfvg-jhg9

References

Patch 2

Advisory 2

Other 1

https://github.com/getgrav/grav

TI-2026-40880 Grav - XML External Entity Injection via SVG Upload CVSS 4.0HIGH 7.1
TI-2026-42219 Grav - Arbitrary File Upload via Avatar Endpoint CVSS 4.0MEDIUM 5.3
TI-2026-10325 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CVSS 4.0MEDIUM 5.1
TI-2026-40879 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection CVSS 4.0CRITICAL 9.3
TI-2026-06424 Grav CMS Cache Value FileCache.php doGet deserialization CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences