CVE-2026-85598: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getgrav grav

CVE-2026-85598 is a cross-site scripting vulnerability in Grav CMS versions 2.0.0 through 2.0.17. The issue arises because save-time XSS detection is not applied to modular pages, allowing authenticated page editors to embed Twig-assembled XSS payloads. When a parent page renders these modular pages, the malicious code executes in the browsers of visitors, potentially including administrators. This vulnerability requires authenticated access with page editing privileges.

An attacker with page editing rights can inject malicious Twig code into modular pages, which executes in the browsers of users viewing the parent page. This can lead to XSS attacks affecting visitors and administrators, potentially enabling session hijacking or other client-side attacks. The vulnerability is limited to authenticated users with editing permissions and does not allow unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict page editing permissions to trusted users only and review modular page content for malicious Twig code. Monitor vendor channels for official fixes or updates.