High severity7.6NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75831
CVE-2026-75831
Description
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-6qw9-4vv5-jr97ghsaADVISORY
- github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20nvd
- github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97nvd
- nvd.nist.gov/vuln/detail/CVE-2026-75831ghsa
- www.vulncheck.com/advisories/grav-before-stored-xss-via-audio-video-source-urlnvd
News mentions
2- Grav CMS: 14 Vulnerabilities Including Critical Privilege Escalation Disclosed TogetherVypr Intelligence · Aug 19, 2026
- Grav CMS: Six Vulnerabilities Including File Write and XSS Disclosed TogetherVypr Intelligence · Aug 18, 2026