CVE-2026-42611

HighCVSS 8.9/10Last modified Oct 26, 2026

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
getgrav	grav	< 2.0.0-beta.2

References

https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663Patch
https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2Exploit, Patch, Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2Exploit, Patch, Vendor Advisory

Timeline

Published: May 11, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-426125.4Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher CVE-2026-426139.4Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled group CVE-2026-426157.2GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.CVE-2026-426167.8In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfsca CVE-2026-426177.1In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in th CVE-2026-426187.1In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of CVE-2026-42626.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the paramet CVE-2026-426265.9HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing).CVE-2026-426276.2In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file CVE-2026-426298.8Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42636.9Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the paramet CVE-2026-426307.5Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.