Medium severity6.4NVD Advisory· Published Sep 4, 2026· Updated Sep 14, 2026
CVE-2026-85598
CVE-2026-85598
Description
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Grav CMS: Seven Vulnerabilities Including RCE and XSS Disclosed in Early September 2026Vypr Intelligence · Sep 5, 2026