CVE-2025-65186: XSS
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65186?
CVE-2025-65186 has a moderate severity level due to the potential for stored Cross Site Scripting (XSS) attacks.
How do I fix CVE-2025-65186?
To fix CVE-2025-65186, upgrade Grav CMS to a version later than 1.7.49 where the XSS vulnerability is addressed.
Who is affected by CVE-2025-65186?
CVE-2025-65186 affects users of Grav CMS version 1.7.49 and below who utilize the page editor functionality.
What kind of attack can be executed via CVE-2025-65186?
CVE-2025-65186 allows for stored Cross Site Scripting (XSS) attacks that can execute malicious scripts when pages are viewed.
Is authentication required to exploit CVE-2025-65186?
Yes, authentication is required as the vulnerability is located in the editor accessible to authenticated users.