CVE-2026-75831 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using versions before 2.0.15, should assess exposure and prioritize updating to the latest version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and update Grav installations, monitor for potential exploitation attempts, and review compensating controls for exposed systems.

Why it matters

CVE-2026-75831 is a stored cross-site scripting vulnerability in Grav before 2.0.15, allowing attackers to inject arbitrary HTML and JavaScript. Defenders should prioritize verifying and updating Grav installations, assessing exposure, and monitoring for potential exploitation attempts.

• Potential injection of arbitrary HTML and JavaScript in viewers' sessions
• Possible exploitation requires user interaction with crafted media URLs
• Verification of Grav version and exposure in environments is necessary
• Remediation priority is updating to Grav 2.0.15 or later

Technical summary

The vulnerability exists in the sourceParsedownElement method, where media URL fragments are concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript. This affects Grav installations before version 2.0.15, particularly those using audio and video media rendering. Defenders should focus on updating to the latest version and assessing exposure in their environments. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.1 and severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying and updating Grav installations to version 2.0.15 or later, and assess exposure in their environments.

Recommended defensive actions

• Verify and update Grav installations to version 2.0.15 or later
• Assess exposure in environments using Grav
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.1 and severity of MEDIUM. However, the corpus does not establish versions, exploitation, impact, or remediation beyond updating to Grav 2.0.15 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.