CVE-2026-75831: Grav before 2.0.15 Stored XSS via audio/video source URL
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Grav versions before 2.0.15 are affected. The available data does not state whether the vulnerable media-rendering path is enabled or reachable in a default installation.
What access does an attacker need to exploit this?
An attacker needs privileges to submit or modify content that can contain audio or video media source URLs, and a victim must view the stored malicious content. Exploitation is network-reachable and requires low privileges and user interaction.
What is the remediation?
Upgrade Grav to version 2.0.15 or later. The provided data does not identify a workaround for environments where upgrading is delayed.
How can I check for existing malicious content?
Review stored content containing audio or video media URLs for injected HTML or JavaScript in media URL fragments, particularly content created or edited by low-privileged users. The data does not provide a definitive detection signature or log indicator.