CVE-2026-11982: Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Grav Admin2from your environment.Uninstall or disable the Admin2 plugin/module if it is not required to eliminate the vulnerable Admin2 Pages API save flow.
- Compensating control
Restrict access to the Admin interface and Pages API to trusted IP addresses, internal networks, or via VPN/WAF to reduce exposure to the stored XSS vulnerability.
- Operational
Review content created or modified via the Admin2 Pages API for malicious scripts or XSS payloads; sanitize or remove any identified payloads and clear application/server caches to remove stored malicious content.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11982?
The severity of CVE-2026-11982 is rated as medium with a CVSS score of 5.1.
How do I fix CVE-2026-11982?
To fix CVE-2026-11982, update your Grav installation to the latest version that addresses this stored XSS vulnerability.
What type of vulnerability is CVE-2026-11982?
CVE-2026-11982 is a stored cross-site scripting (XSS) vulnerability.
In which version of Grav is CVE-2026-11982 present?
CVE-2026-11982 is present in Grav version 2.0.0-rc.9 with Admin2 version 2.0.0-rc.14.
What is the impact of CVE-2026-11982?
The impact of CVE-2026-11982 is the potential execution of malicious scripts in the context of an admin user due to the missing XSS safety check.