These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-58657 is a stored CSS injection vulnerability in Grav before 2.0.0. The vulnerability exists in the Markdown image resize() media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the resize() action in Excerpts::processMediaActions() writes caller-controlled values directly into the image's styleAttributes. A lower-privileged content editor who c [truncated]
The Grav API plugin 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content — including PHP code, SVG wit [truncated]
CVE-2026-11982 is a stored cross-site scripting (XSS) vulnerability in Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14, affecting the Admin2 Pages API save flow. The CVE record was published on 2026-06-18T17:16:28.093Z and was last modified on 2026-06-22T17:56:35.757Z. This vulnerability allows for stored cross-site scripting (XSS) attacks, which could potentially allow an attacker to inject malicious scripts int [truncated]
A vulnerability was found in Grav CMS, affecting the FileCache::doGet function in the file system/src/Grav/Framework/Cache/Adapter/FileCache.php component. The vulnerability allows for deserialization and can be exploited remotely with high complexity. The attack requires a high level of complexity and appears to be difficult to exploit. However, the exploit has been made public and could be used by attac [truncated]