CVE-2025-66843

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-15 · updated 2026-10-14
Weakness: CWE-79

Description

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.

Affected products

getgrav grav: before 1.7.49.5 — fixed in 1.7.49.5

How to fix

Upgrade to a fixed version: getgrav grav 1.7.49.5. Check the vendor advisory for mitigations.

References

https://github.com/Yohane-Mashiro/grav_cve/issues/1
https://github.com/Yohane-Mashiro/grav_cve/issues/1

Get alerted when CVE-2025-66843 or the next vulnerability affects your stack