CVE-2026-64851 getgrav CVE debrief

Who should care

Administrators and security teams responsible for Grav installations should assess exposure and prioritize remediation of Grav Shortcode Core versions prior to 6.2.2. This includes reviewing system deployments, verifying affected scope, and applying vendor guidance for secure configurations.

Why it matters

CVE-2026-64851 is a stored cross-site scripting vulnerability in Grav Shortcode Core that can lead to malicious code execution in user browsers. Administrators and security teams responsible for Grav installations should assess exposure and prioritize remediation of versions prior to 6.2.2.

• Stored cross-site scripting can lead to malicious code execution in user browsers
• Administrators who view affected pages may have their sessions compromised
• Visitors to affected pages may be exposed to malicious code execution

Technical summary

The Grav Shortcode Core plugin passes shortcode syntax through Security::detectXss() without proper encoding, allowing an attacker to concatenate an attacker-controlled parameter into HTML. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2 with proper encoding and security measures implemented to prevent such attacks in the future.

Defensive priority

Administrators and security teams should prioritize assessment and remediation of Grav Shortcode Core versions prior to 6.2.2.

Recommended defensive actions

• Assess exposure of Grav Shortcode Core versions prior to 6.2.2
• Upgrade to Grav Shortcode Core version 6.2.2 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in Grav Shortcode Core. The issue is fixed in version 6.2.2. Evidence is based on CVE Program and NVD publications, with limited additional source information available. Defenders should verify affected scope, severity, and vendor guidance through official advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.