CVE-2026-75831: Stored Cross-Site Scripting in Grav CMS Audio/Video Media Rendering

The Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-75831 and GHSA-6qw9-4vv5-jr97, exists within the core media processing architecture of the Grav Content Management System (CMS). Grav utilizes a flat-file structure and processes Markdown elements through specialized traits that generate HTML structures. When handling audio and video file attachments, the system renders media elements via the Parsedown engine by invoking specific trait methods.

Specifically, the AudioMediaTrait and VideoMediaTrait components are responsible for transforming media markup into standard HTML <audio> and <video> tags. During this process, the system dynamically generates <source> elements using media path variables. If an authenticated user with page editing privileges submits a crafted path containing specific characters, those characters bypass standard encoding pipelines.

This vulnerability allows an attacker to insert arbitrary HTML and JavaScript directly into the rendered output of the page. Consequently, any subsequent user who accesses the compromised page will execute the injected script within their browser context. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

The primary defect resides in the implementation of the sourceParsedownElement method within both AudioMediaTrait and VideoMediaTrait. In vulnerable versions of Grav (prior to 2.0.15), this method constructs the HTML representing the media source by concatenating the unescaped path variable, $location, directly into a raw HTML template string.

While traditional image elements process source parameters through an attribute-escaping pipeline that filters special characters, the audio and video subsystems construct a hardcoded <source src="..."> string inside a rawHtml array key. This bypassed the standard security wrappers of the Parsedown engine. When a content editor uploads or links a media file, any query parameters or URL fragment structures appended to the filename are captured in the $location variable.

Although the core Grav architecture contains filtering logic to strip leading hash symbols (#) from parameters via the urlHash helper, it does not neutralize quotes, angle brackets, or script structures within the body of the URL fragment itself. This allows an attacker to craft a media reference where the fragment contains double quotes to break out of the HTML attribute value boundary.

A comparison of the vulnerable codebase and the patched implementation demonstrates how the unescaped path variable was processed. In vulnerable releases, the code directly concatenated the path variable into the HTML string.

// Vulnerable implementation in AudioMediaTrait.php
protected function sourceParsedownElement(array $attributes, $reset = true)
{
    // ...
    return [
        'name' => 'audio',
        'rawHtml' => '<source src="' . $location . '">Your browser does not support the audio tag.',
        'attributes' => $attributes
    ];
}

The fix, introduced in Grav version 2.0.15, wraps the $location variable in PHP's standard htmlspecialchars function with the ENT_QUOTES configuration flag. This ensures that any double or single quotes, as well as angle brackets, are fully encoded to their respective HTML entities before rendering.

// Patched implementation in AudioMediaTrait.php
protected function sourceParsedownElement(array $attributes, $reset = true)
{
    // ...
    return [
        'name' => 'audio',
        'rawHtml' => '<source src="' . htmlspecialchars($location, ENT_QUOTES, 'UTF-8') . '">Your browser does not support the audio tag.',
        'attributes' => $attributes
    ];
}

Because the browser parser treats encoded entity characters as literal strings rather than executable syntactic elements, the execution boundary remains intact. An attacker's attempt to break out of the src attribute is rendered inert.

Exploitation requires an attacker to possess privileges that allow the creation or modification of Markdown pages within the Grav CMS. Such roles typically include Authors, Editors, or Contributors. The attacker initiates the exploit by embedding a media attachment containing a malformed filename fragment.

The payload relies on appending a double-quote character, a closing angle bracket, and a scripting payload to the media URL. For example, inserting a payload like video.mp4#"><script>alert(document.cookie)</script> breaks the structural syntax of the <source> tag.

When the system renders this Markdown page, the output converts into the following HTML structure: <source src="video.mp4#"><script>alert(document.cookie)</script>">. The browser parses the script block as an independent DOM node and executes it immediately under the security origin of the hosting domain.

The impact of CVE-2026-75831 is significant due to the stored nature of the script. Once an administrative user views the page, the injected JavaScript executes with the permissions of that administrator's active session. This can lead to complete session hijacking, cookie theft, or administrative actions performed silently in the background.

Because Grav uses administrative tokens and REST APIs to manage user accounts and system configuration, the malicious script can trigger requests that create new super-administrator accounts or execute file upload commands. Such actions can result in arbitrary code execution on the server hosting the CMS.

The vulnerability is assigned a CVSS v3.1 score of 7.6, indicating high severity due to the potential for scope change and high confidentiality impact. The EPSS score indicates a low initial probability of active exploitation in the wild, but administrators should treat any instance of stored script injection as critical.

The primary remediation strategy is upgrading the Grav CMS core installation to version 2.0.15 or newer. This version implements comprehensive attribute escaping on all audio and video media rendering pathways.

For environments where immediate system upgrades are impractical, administrators should implement a Content Security Policy (CSP) header that restricts script execution. Specifically, enforcing a policy that forbids inline scripts or requires unique cryptographic nonces prevents the injected payload from running even if the HTML structure is compromised.

Additionally, security teams can audit the existing Markdown pages by querying the file system for media extensions followed by suspicious HTML characters. Running a system-wide search inside the user/pages/ directory using regular expressions assists in locating pre-existing malicious payloads.