CVE-2025-64059: XSS
Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires high privileges: an administrator must be able to use the Home Page editor. It also requires local access, high attack complexity, and user interaction according to the supplied vector.
Is this meaningfully different from existing administrator capabilities?
Its relevance as stored XSS is disputed because Grav administrators can already modify templates, install plugins, and upload other executable content. The supplied information does not establish an additional privilege boundary beyond administrator access.
What is the reported impact?
The reported impact is limited to integrity, with no stated confidentiality or availability impact. The supplied severity is low, with a CVSS score of 1.8.