VYPR
Published Sep 5, 2026· Updated Sep 6, 2026· 1 source

Grav CMS: Seven Vulnerabilities Including RCE and XSS Disclosed in Early September 2026

Key findings • Seven vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity. • Key risks include Remote Code Execution (CVE-2026-85604)…

Key findings

  • Seven vulnerabilities disclosed for Grav CMS between 2026-09-04 and 2026-09-05, ranging from Medium to High severity.
  • Key risks include Remote Code Execution (CVE-2026-85604) and account takeover via password reset manipulation (CVE-2026-86196).
  • Multiple Cross-Site Scripting (XSS) flaws affect core components and plugins, impacting both administrators and site visitors.
  • Patches are available, with affected versions and specific fixes detailed across the various CVEs.
  • Users are urged to update Grav CMS and relevant plugins to secure versions promptly.

On September 4th and 5th, 2026, a batch of seven vulnerabilities was disclosed for the Grav CMS, affecting various components and plugins. These vulnerabilities range in severity from Medium to High, with several posing significant risks such as remote code execution and account takeover. The disclosures highlight issues in core functionalities like asset handling, password resets, and templating, as well as in plugins and the admin interface.

Several vulnerabilities center around cross-site scripting (XSS), a common web security flaw. CVE-2026-86197, a Medium severity vulnerability, exists in the Twig sandbox policy's allowlisting of addJs and addCss methods. This allows page editors to inject scripts by registering malicious assets that are rendered without proper escaping. Similarly, CVE-2026-85601 (Medium) in the Grav Admin component fails to sanitize output from marked.parse() before injecting it into the DOM, enabling attackers to execute arbitrary code within admin sessions via specially crafted changelogs. Another XSS vulnerability, CVE-2026-85600 (Medium), resides in the tHtml() function within the Grav Admin plugin, where untrusted parameters are substituted into translation templates and parsed as Markdown, potentially leading to stored XSS. Furthermore, CVE-2026-85599 (High) affects the Grav Shortcode Core plugin, with stored XSS vulnerabilities in the [lorem] tag and [details] summary parameters, allowing page editors to inject malicious HTML and JavaScript into rendered pages. Lastly, CVE-2026-85598 (Medium) involves Grav versions 2.0.0 through 2.0.17 failing to apply save-time XSS detection to modular pages, enabling authenticated editors to store XSS payloads within Twig-assembled content.

Beyond XSS, more critical vulnerabilities were also detailed. CVE-2026-85604 (High), with a CVSSv3 score of 8.8, presents a remote code execution (RCE) risk due to a flaw in the Twig sort filter. The sortFunc wrapper in GravExtension.php incorrectly sets isSandboxed to false, allowing the sort filter to accept plain function names within the sandbox, bypassing security measures. Another High severity vulnerability, CVE-2026-86196, impacts the Grav API plugin. Versions prior to 1.0.20 construct password reset links using an untrusted Host header. This allows unauthenticated attackers to craft malicious Host headers in password reset requests, redirecting password reset tokens to attacker-controlled domains and potentially leading to account takeover.

The affected versions and patches vary across the disclosed vulnerabilities. CVE-2026-86197 and CVE-2026-85601 are addressed in Grav versions before 2.0.20. CVE-2026-85604 is fixed in Grav versions before 2.0.18, specifically affecting versions up to 2.0.17. CVE-2026-85599 requires updating Grav Shortcode Core to versions before 6.2.5. CVE-2026-85598 impacts Grav versions 2.0.0 through 2.0.17. The Grav API plugin vulnerability CVE-2026-86196 is resolved in versions before 1.0.20. Users are strongly advised to update their Grav CMS installations and relevant plugins to the patched versions to mitigate these security risks.

This batch of vulnerabilities underscores the importance of timely patching and secure coding practices within the Grav CMS ecosystem. The range of issues, from stored XSS affecting site visitors to RCE and account takeover risks, highlights the need for administrators to stay vigilant and apply updates promptly. The disclosures, clustered around early September 2026, emphasize the ongoing efforts by security researchers to identify and report flaws, and the critical role of prompt vendor response in protecting user data and system integrity. Users should review their specific Grav installations and plugin versions to ensure they are protected against these newly disclosed threats.

Synthesized by Vypr AI