medium6.1
CVE-2025-65186
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
Impact
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getgrav/grav | <= 1.7.49 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getgrav | Grav | Version 1.7.49 |