CVE-2026-55890: Grav CMS Stored XSS Vulnerability

CVE-2026-55890 Overview

CVE-2026-55890 is a stored cross-site scripting (XSS) vulnerability in Grav, a file-based web platform. The flaw exists in versions prior to 2.0.0-rc.9 and stems from an incomplete fix for a prior issue (CVE-2026-42841). The MediaObjectTrait::style method remains reachable through the Markdown excerpt-action pipeline, allowing an editor to inject unsanitized CSS into the rendered <img style="…"> attribute. Exploitation requires an authenticated editor to save malicious Markdown content, which then executes in the browser of higher-privilege viewers.

Critical Impact
An authenticated editor can persist attacker-controlled CSS into image style attributes, enabling clickjacking, phishing overlays, or CSS-based data exfiltration against administrators who view the affected content.

Affected Products

Grav CMS versions prior to 2.0.0-rc.9
Grav MediaObjectTrait component (system/src/Grav/Common/Media/Traits/MediaObjectTrait.php)
Grav Markdown excerpt-action pipeline handling image style parameters

Discovery Timeline

2026-07-10 - CVE-2026-55890 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-55890

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw classified as [CWE-79]. Grav's Markdown parser exposes an image style syntax such as ![Example](myimg.png?style=float:left). This syntax routes into the MediaObjectTrait::style method, which appends the editor-supplied value directly to the styleAttributes array. The value is then written verbatim into the rendered <img style="…"> HTML attribute without validation.

While Parsedown passes the value through htmlspecialchars, preventing an attacker from breaking out of the attribute, unconstrained CSS still permits stored attacks against higher-privilege viewers. Attackers can construct phishing overlays, clickjacking primitives, or CSS-based exfiltration payloads that trigger when an administrator renders the affected page.

Root Cause

The root cause is an incomplete remediation of CVE-2026-42841. The prior patch addressed the attribute() sink with a style denylist entry but left the sibling style() method reachable through the same Markdown excerpt-action pipeline. Editor-controlled CSS was concatenated into the rendered element without any declaration-level validation.

Attack Vector

An authenticated user with editor privileges creates or modifies Markdown content that references an image with a ?style= query parameter containing malicious CSS. When a higher-privilege user, such as an administrator, subsequently views the rendered page, the injected CSS executes in their browser session and can be leveraged for UI redressing or data exfiltration.

php

     * Allows to add an inline style attribute from Markdown or Twig
     * Example: ![Example](myimg.png?style=float:left)
     *
+    * Reachable from Markdown via `?style=…` on image excerpts, so the CSS is
+    * editor-controlled and is written verbatim into the rendered
+    * `<img style="…">`. We validate each declaration and silently drop the
+    * whole value if any of it would open a phishing-overlay, clickjacking, or
+    * CSS-exfiltration primitive. This is the sibling sink to the `attribute()`
+    * `style` denylist entry. GHSA-pmf8-g7c8-7v54 (follow-up to
+    * GHSA-r7fx-8g49-7hhr).
+    *
     * @param string $style
     * @return $this
     */
    public function style($style)
    {
+       if (!is_string($style) || !self::isSafeStyleValue($style)) {
+           return $this;
+       }
        $this->styleAttributes[] = rtrim($style, ';') . ';';

        return $this;
    }

Source: GitHub Commit 24fd6cbc

Detection Methods for CVE-2026-55890

Indicators of Compromise

Markdown content containing image references with suspicious ?style= parameters, especially values referencing position, z-index, background, url(, or @import.
Rendered HTML pages where <img> tags carry unexpected or overly complex inline style attributes.
Recent edits by non-administrator accounts touching Markdown files that include image media syntax.

Detection Strategies

Scan the Grav user/pages directory for Markdown files containing ?style= query fragments on image references and review those declarations.
Compare deployed Grav version against 2.0.0-rc.9 across production and staging environments.
Review web server access logs for editor actions modifying page content followed by administrator visits to those pages.

Monitoring Recommendations

Enable audit logging for the Grav admin panel to capture content edits by editor-role accounts.
Deploy a strict Content Security Policy (CSP) that blocks inline styles and external resource loads from unexpected origins.
Monitor for anomalous CSS patterns in stored content, such as expression(, url(data:, or absolute positioning combined with high z-index values.

How to Mitigate CVE-2026-55890

Immediate Actions Required

Upgrade Grav to version 2.0.0-rc.9 or later, which introduces the isSafeStyleValue validation in MediaObjectTrait::style.
Audit existing Markdown content for image references containing ?style= parameters and remove or sanitize suspicious declarations.
Review editor-role account assignments and revoke privileges for accounts that no longer require content authoring access.

Patch Information

The fix is available in Grav 2.0.0-rc.9. The patch, referenced in commit 24fd6cbc438e12310b126d1176e7d7601203a6f2, adds an isSafeStyleValue check to MediaObjectTrait::style that validates each CSS declaration and silently drops any value that could enable phishing overlays, clickjacking, or CSS exfiltration. See the GitHub Security Advisory GHSA-pmf8-g7c8-7v54 and the Grav 2.0.0-rc.9 release notes for full details.

Workarounds

Restrict editor role assignments to fully trusted users until the upgrade is applied.
Enforce a strict Content Security Policy that disallows inline style attributes and external resource loading in rendered pages.
Manually review all Markdown content submitted by non-administrator accounts before publishing to production.

bash

# Upgrade Grav to the patched release
cd /path/to/grav
bin/gpm selfupgrade
# Verify the installed version is 2.0.0-rc.9 or later
bin/grav --version