Dashboard / CVE-2026-42841

CVE-2026-42841

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 49/100
Published: 2026-05-11 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Passive
S: X
AT: Present
VC: High
VI: Low
VA: None

Description

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing permissions can inject an executable JavaScript event-handler attribute into rendered image HTML through Grav's Markdown media action syntax. The issue is caused by Markdown image query parameters being converted into callable media actions. The public attribute() media method can be reached this way, allowing an editor to set an arbitrary HTML attribute name and value on the generated image element. This vulnerability is fixed in 2.0.0-beta.2.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
getgrav grav < 1.8.0
getgrav grav 2.0.0

References & Advisories (2)

Bug Bounty Relevance

49 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.42%
Raw Score 0.004200
Percentile 36.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00420
2026-10-28
0.00420

Intelligence Sources

nvd ref →

External Links