CVE-2026-58657: Stored CSS Injection in Grav CMS Media Resize Parser

Grav CMS is a flat-file content management system that processes content written in Markdown. Within its media pipeline, users can append query parameters to image references to perform dynamic manipulations, such as resizing, cropping, or scaling.

The vulnerability, designated as CVE-2026-58657, resides within the media manipulation handler. Specifically, when parsing the resize parameter, the system fails to sanitize or validate the dimensions supplied in the URL query string.

This lack of sanitization allows an attacker with page creation or editing privileges to insert raw CSS syntax. Because the generated dimensions are directly written to inline style attributes, this results in stored CSS injection when the page is rendered for other users.

The root cause of this vulnerability lies in the lack of type verification within the resize() method. This method is implemented inside the StaticResizeTrait trait, located at system/src/Grav/Common/Media/Traits/StaticResizeTrait.php.

During Markdown processing, Grav extracts query parameters from image URLs and forwards them to Excerpts::processMediaActions(). When the resize action is processed, the raw width and height strings are assigned directly to the internal $styleAttributes array.

Because the input values are concatenated directly with the 'px' string without casting to integers, any character sequence containing semicolons is preserved. Semicolons act as delimiters in CSS, enabling an attacker to terminate the width property and append arbitrary CSS properties to the inline style block.

A comparison of the vulnerable and patched code reveals how the input validation check was missing. In the vulnerable version, the parameters are handled as raw variables:

public function resize($width = null, $height = null)
{
    if ($width) {
        $this->styleAttributes['width'] = $width . 'px';
    }
    // ...
}

The fix introduces strict validation by verifying if the values are numeric and casting them to integers. This neutralizes any non-numeric characters before they are added to the inline style array:

$width = is_numeric($width) ? (int) $width : 0;
$height = is_numeric($height) ? (int) $height : 0;
 
if ($width > 0) {
    $this->styleAttributes['width'] = $width . 'px';
} else {
    unset($this->styleAttributes['width']);
}

This validation ensures that only positive integer values are rendered inside the final style attribute. Non-numeric inputs evaluate to 0 and are completely discarded, preventing the inject path.

To exploit this vulnerability, an attacker must have permissions to create or modify pages within the Grav CMS instance. This restriction makes the threat vector post-authentication, though achievable by users with low-privilege roles such as content editors or contributors.

The attacker crafts an image tag within the Markdown editor containing a malformed resize parameter. An example payload structures the query parameter to include a semicolon followed by positioning directives:

![Target](image.png?resize=100;position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;background:red;,200)

When processed by the server, the template parser renders an image tag with a corrupted inline style attribute. The browser parses the semicolon as a delimiter, overriding the layout with a full-screen block on top of the original interface. This visual overlay can be customized to display deceptive content.

The impact of this vulnerability is centered around UI redressing and potential credential theft. While CSS injection does not execute arbitrary JavaScript directly, modern CSS features allow sophisticated manipulation of the user interface.

Attackers can utilize absolute positioning and high z-index elements to craft phishing forms over the legitimate administration interface. When an administrator views the page, they may interact with the fake form, unknowingly submitting sensitive inputs to an external server.

Additionally, CSS attribute selectors can be used to exfiltrate sensitive tokens. By utilizing background image URLs that trigger conditionally based on input attributes, an attacker could leak CSRF tokens or user-typed data to an out-of-band logger.

The primary remediation path is to update the Grav CMS installation to version 2.0.0 or higher. This release integrates the type-casting logic in the StaticResizeTrait class to completely block the injection path.

If upgrading is not immediately possible, administrators should manually apply the code-level patch to the StaticResizeTrait.php file. This involves casting the input parameters to integers before they are evaluated or appended to style arrays.

In addition, implementing a strict Content Security Policy can restrict the impact of CSS injection. Configuring the style-src directive without 'unsafe-inline' prevents the execution of arbitrary inline style rules, though it may affect normal operation if inline styles are required by the theme.