CVE-2026-42611 - Vulnerability Analysis
HighCVSS: 8.9Last Updated: May 12, 2026
Grav - Stored XSS & Remote Code Execution
Overview
Grav < 2.0.0-beta.2 contains a stored XSS caused by injection of SVG elements by low-privileged users, letting attackers escalate to remote code execution via admin-nonce when a Super Admin visits the page.
Severity & Score
Impact
Attackers can execute scripts, disclose system info, and achieve full server compromise via remote code execution.
Mitigation
Update to version 2.0.0-beta.2 or later.
References
Social Media Activity(2 posts)
š CVE-2026-42611 - High (8.9) Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available u... š https://www.thehackerwire.com/vulnerability/CVE-2026-42611/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š CVE-2026-42611 - High (8.9) Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available u... š https://www.thehackerwire.com/vulnerability/CVE-2026-42611/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original postRelated Resources
Details
- CVE ID
- CVE-2026-42611
- Severity
- High
- CVSS Score
- 8.9
- Type
- stored_xss
- Status
- confirmed
- EPSS
- 4.1%
- Social Posts
- 2
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H