CVE-2026-55890: Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaOb

mediumCVSS 4.8CVE-2026-55890

Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaObjectTrait::style method reachable through the same Markdown excerpt-action pipeline, allowing an editor to save Markdown image style parameters that are written into the rendered img style attribute without sanitization. This issue is fixed in version 2.0.0-rc.9.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.8
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-55890

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-55890	coverage & exploitation status	NVD · CVE.org

Recent advisories for Grav is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59193: Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash…nvd · 2026-07-10
unknownCVE-2026-59190: grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create a…nvd · 2026-07-10
unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10
unknownCVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists…nvd · 2026-07-10
mediumCVE-2026-55885: Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup…nvd · 2026-07-10
unknownCVE-2026-53653: Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthentica…nvd · 2026-07-10

CVE-2026-55890: Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored XSS through the Markdown media attribute action (CVE-2026-42841) leaves the sibling MediaOb

Details

Referenced CVEs

Recent advisories for Grav is a

More from NVD Recent CVEs