CVE-2026-85598

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.

  • Published Sep 4, 2026
  • CVSS 5.1 medium
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-85598 at the National Vulnerability Database