CVE-2026-64628 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those with admin.pages permission, should assess exposure and prioritize verification and remediation. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified. Defenders should also track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-64628 is a stored cross-site scripting vulnerability in Grav's shortcode-core attribute handlers that allows attackers with admin.pages permission to inject malicious JavaScript, enabling session hijacking and elevation of privileges. Defenders should prioritize verifying and updating Grav installations to prevent exploitation.

• Session hijacking via admin nonce theft
• Malicious JavaScript execution in viewer's browser
• Elevation of privileges for attackers with admin.pages permission

Technical summary

The vulnerability is caused by inadequate validation of shortcode parameters in Grav's shortcode-core attribute handlers. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators. This enables session hijacking via admin nonce theft. The vulnerability allows for elevation of privileges for attackers with admin.pages permission. Defenders should prioritize verifying and updating Grav installations to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating Grav installations to prevent exploitation.

Recommended defensive actions

• Verify and update Grav installations to the latest version.
• Restrict admin.pages permission to trusted users.
• Monitor for suspicious activity on Grav installations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. The vulnerability allows attackers with admin.pages permission to inject malicious JavaScript through shortcode attributes. The CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. However, defenders need to verify the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.