CVE-2026-75831
published 2026-08-18CVE-2026-75831: Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The…
PriorityP336high7.6CVSS 3.1
AVNACLPRLUIRSCCHILAN
EPSS
0.35%
27.5th percentile
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.15 | 2.0.15 |
| getgrav | grav | >= 0 < 2.0.15 | 2.0.15 |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Stored XSS via Markdown audio/video media <source> URL
ghsa·2026-09-17·CVSS 4.8
CVE-2026-75831 [MEDIUM] CWE-79 Grav: Stored XSS via Markdown audio/video media <source> URL
Grav: Stored XSS via Markdown audio/video media URL
**Target:** github.com/getgrav/grav
**Affected resource:** `Grav\Common\Media\Traits\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f`
**Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS advisory [CVE-2026-42841](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr), same PR:H / S:C / C:H / I:L)
**Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation)
## Summary
A Markdown audio or video embed renders its `` element as **raw HTML** with the media URL concatenated unescaped. The URL fragment is reflected without any encoding, so `` breaks out of `` and injec
GHSA
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method.
ghsa_unreviewed·2026-08-18
CVE-2026-75831 [MEDIUM] CWE-79 Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method.
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97https://www.vulncheck.com/advisories/grav-before-stored-xss-via-audio-video-source-urlhttps://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97
2026-08-18
Published