Grav CMS: Five Vulnerabilities Including Privilege Escalation and XSS Disclosed Together
Five vulnerabilities impacting Grav CMS, including privilege escalation and stored XSS, were disclosed together between September 4-5, 2026.
Key findings
- Five vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity.
- Privilege escalation flaws in grav-plugin-api allow non-super users to gain administrative control.
- Path traversal in the admin plugin enables authenticated users to write arbitrary files.
- Stored XSS vulnerabilities affect the admin plugin and Shortcode Core, impacting administrators and site visitors.
- Patches are available in Grav versions 1.10.55 and grav-plugin-api 1.0.20.
On September 4th and 5th, 2026, a batch of seven vulnerabilities was disclosed for the Grav CMS, affecting various components and plugins. These vulnerabilities range in severity from Medium to High, with key risks including privilege escalation and cross-site scripting (XSS). Patches are available for all disclosed vulnerabilities, and users are urged to update Grav CMS and relevant plugins to secure versions promptly.
The grav-plugin-api versions before 1.0.20 are affected by two privilege escalation vulnerabilities. CVE-2026-86195 describes a flaw where the stripSuperFlags() method fails to strip dot-keyed super flags, allowing a non-super user manager with specific permissions to escalate privileges. Similarly, CVE-2026-86193 details how the plugin fails to validate group-inherited super permissions in user-management guards, enabling non-super user managers to modify super-admin accounts by patching password fields, ultimately gaining full administrative control.
Grav versions before 1.10.55 and the Grav Admin plugin (getgrav/grav-plugin-admin2) versions up to 2.0.19 are also impacted. CVE-2026-85603, a medium-severity path traversal vulnerability in the admin plugin's Save As action, allows an authenticated admin user with page creation permissions to write arbitrary .md files outside the intended directory by manipulating the language code parameter. Additionally, CVE-2026-85600, a stored XSS vulnerability in the admin plugin's tHtml() function, allows attackers to inject malicious markdown via usernames, which are then executed in the administrative interface.
Further compounding the issues, Grav Shortcode Core before version 6.2.5 contains stored XSS vulnerabilities in its lorem tag and details summary parameters (CVE-2026-85599). These vulnerabilities allow attackers with page-edit access to inject arbitrary HTML and JavaScript into rendered pages, which execute in the browsers of all page visitors without proper escaping.
The disclosed vulnerabilities were fixed in Grav versions 1.10.55 and grav-plugin-api 1.0.20. Users are strongly advised to update to these versions to mitigate the risks associated with these security flaws.
This batch of vulnerabilities highlights the importance of timely patching and secure coding practices within the Grav CMS ecosystem. Users should remain vigilant and apply updates as soon as they become available to protect their sites from potential compromise. The coordinated disclosure of these issues by security researchers underscores the ongoing efforts to identify and address security weaknesses in popular content management systems.