Grav CMS versions up to 2.0.0-rc.9 contain a stored CSS injection vulnerability via the Markdown image resize() media action. This flaw allows a lower-privileged content editor to inject crafted CSS into image style attributes, which are then rendered when viewed by higher-privileged users. The vulnerability enables UI redress and content manipulation attacks without requiring JavaScript execution. The issue is fixed in Grav 2.0.0.