CVE-2026-85598: Grav CMS Modular Page XSS Vulnerability

CVE-2026-85598 is a stored cross-site scripting flaw in Grav CMS versions 2.0.0 through 2.0.17 affecting modular pages. Authenticated editors can inject malicious Twig code that executes in visitor browsers. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-85598 Overview

CVE-2026-85598 is a stored Cross-Site Scripting (XSS) vulnerability in the Grav flat-file content management system (CMS). Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages. Authenticated users with page-edit rights can store Twig-assembled payloads inside child modules. When the parent modular page is rendered, the payload executes in the browser of every visitor, including administrators. The flaw is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated page editors can execute arbitrary JavaScript in administrator sessions, enabling account takeover and further compromise of the Grav instance.

Affected Products

Grav CMS version 2.0.0
Grav CMS versions 2.0.1 through 2.0.16
Grav CMS version 2.0.17

Discovery Timeline

2026-09-04 - CVE-2026-85598 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85598

Vulnerability Analysis

Grav supports modular pages, which assemble content from multiple child pages into a single rendered view. The save-time content sanitization pipeline that inspects standard pages for XSS payloads does not extend to modular child pages. Editors can therefore submit Twig markup that reaches the rendering engine untouched. When the parent page is loaded, Grav evaluates the Twig code and emits attacker-controlled HTML and JavaScript into the response.

Because the payload persists in stored page content, every subsequent visitor triggers execution. Administrators browsing the affected page in the admin panel or on the front end will run the injected script under their session context. This enables session theft, CSRF-style privileged actions, and pivoting into server-side Twig features exposed to authenticated users.

Root Cause

The root cause is inconsistent enforcement of input neutralization. Grav's save-time XSS detection applies to standard page content but omits modular page bodies, leaving a bypass path for Twig-assembled markup that stores hostile script in the content tree.

Attack Vector

Exploitation requires network access to the Grav admin interface and a valid account with page-edit privileges. The attacker creates or edits a modular child page containing Twig directives that emit script content. Once saved, any user who loads the parent modular page executes the payload. User interaction is required in the form of a page visit. Refer to the GitHub Security Advisory GHSA-fg8g-663r-f366 and the VulnCheck Advisory for additional context.

No verified proof-of-concept code has been released. See the linked advisories for technical detail.

Detection Methods for CVE-2026-85598

Indicators of Compromise

Modular child page files (.md or .yaml) under user/pages/ containing unexpected <script> tags, event handlers such as onerror= and onload=, or Twig blocks that emit raw HTML.
Admin panel audit entries showing page-edit or page-create actions by non-administrator accounts against modular page trees.
Outbound requests from administrator browsers to unknown domains shortly after loading a modular page in the Grav admin UI.

Detection Strategies

Perform static review of all pages beneath modular/ directories for Twig tags like {{ ... }} and {% ... %} that produce HTML or JavaScript.
Compare current page content against version control history to identify unauthorized additions of script or Twig rendering directives.
Deploy a Content Security Policy (CSP) in report-only mode to surface script executions originating from inline sources.

Monitoring Recommendations

Log and alert on all Grav admin authentication events and page-write operations, correlating editor accounts with source IP addresses.
Monitor web server access logs for administrator sessions that hit modular page URLs followed by anomalous POST requests to admin endpoints.
Enable file integrity monitoring on the user/pages/ directory to detect content changes outside expected editorial workflows.

How to Mitigate CVE-2026-85598

Immediate Actions Required

Upgrade Grav to a version later than 2.0.17 that includes the fix referenced in GHSA-fg8g-663r-f366.
Audit all existing modular pages for injected Twig or HTML payloads before restoring public access.
Review the editor role assignments and revoke page-edit permissions from accounts that do not require them.

Patch Information

Refer to the GitHub Security Advisory GHSA-fg8g-663r-f366 for the fixed release and upgrade guidance. Apply the upgrade to every Grav instance running versions 2.0.0 through 2.0.17.

Workarounds

Restrict access to the Grav admin interface using network controls such as IP allow-listing or VPN gating until the patch is applied.
Temporarily disable modular page editing for non-administrator accounts by tightening role-based access in user/accounts/ and admin permissions.
Enforce a strict Content Security Policy that blocks inline script execution to reduce the impact of stored payloads.

bash

# Example strict CSP header to mitigate inline script execution
# Add to the web server configuration serving the Grav site
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"