CVE-2026-58657 Details
Description
Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpts::processMediaActions() writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor who can edit page Markdown can store a crafted image URL with semicolon-delimited CSS declarations in the resize parameters, which are rendered into the final <img style=...> attribute when a higher-privileged reviewer/admin views the page or preview. This does not require JavaScript execution but enables UI redress/overlay and content-manipulation attacks (e.g., a full-viewport fixed overlay). Fixed in 2.0.0.
A stored CSS injection vulnerability has been identified in Grav versions prior to 2.0.0, affecting through 2.0.0-rc.9 and the 2.0 branch. The vulnerability arises in the Markdown image 'resize()' media action, where caller-controlled values are directly written into the image's style attributes. This allows a lower-privileged content editor to inject CSS declarations that are rendered when a higher-privileged user views the page or preview. The issue does not require JavaScript execution but enables UI redress and content manipulation attacks, such as creating a full-viewport fixed overlay.
Users can update to Grav version 2.0.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/getgrav/grav/commit/6582166173bb8eb5869d96aea384e0e73777c94c | [email protected] | Source CodeVendor |
| https://github.com/getgrav/grav/commit/e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8 | [email protected] | Source CodeVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-stored-css-injection-via-markdown-image-resize-action | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 2.0.0-rc.9, < 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |