medium6.4
CVE-2026-85598
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payl…
Impact
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
Affected products
| Product | Affected versions |
|---|---|
| Grav Versions 2.0.0 | through 2.0.17 |
Versions were read from the advisory text. No structured product data has been published for this record yet.