CVE-2026-85600 Details
Description
Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.
A stored cross-site scripting vulnerability has been identified in Grav Admin plugin versions through 2.0.19. The issue arises in the 'tHtml()' function, which improperly handles user-supplied data, such as usernames, by inserting it into translation templates without adequate sanitization. This allows for the inclusion of HTML payloads, which are executed when an administrator views certain UI elements. The vulnerability exploits a gap in Grav's username validation, which fails to block HTML metacharacters, enabling the registration of malicious usernames that can execute scripts in the context of the admin's session.
Users are advised to update Grav Admin to version 2.0.21 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-96xm-c5hr-59rx | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-96xm-c5hr-59rx | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-admin-before-2.0.21-stored-xss-via-username | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav Admin2 | <= 2.0.19 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 5, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |