Incomplete patch for Stored CSS Injection in Grav CMS via Markdown style param (GHSA-r7fx-8g49-7hhr)

Vulnerability Overview Title: Stored CSS injection via Markdown image ?style=... reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr Description: This vulnerability is an incomplete fix for GHSA-r7fx-8g49-7hhr. The maintainers blocked dangerous attribute names (such as , , , , ) through the method. However, the method is accessible via the same Markdown excerpt processing pipeline and allows users to inject arbitrary CSS via the parameter. Affected Versions: Fixed Versions: Impact Scope Trust Boundary: The vulnerability exists within the trust boundary defined in . Editors can operate within their role permissions, while higher-privileged administrators may be attacked when loading pages edited by editors. Specific Impacts: Phishing overlay: Full-screen, fixed-position UI with attacker-controlled background/content; administrators are redirected to the attacker's overlay when clicking expected actions. UI redressing / clickjacking: Invisible overlays cover administrator button clicks. CSS selector sink in form field: Injection of CSS selectors ( ) into form fields targets the form fields themselves, compromising higher-privileged view interactions. Persistent admin-UI denial-of-service: Full-screen, fixed-position background/white overlay pages persist until the administrator manually removes the violating content. Remediation Recommended Fix: Apply the same validation used in to . Code Example: Alternative Approach: Completely deprecate the Markdown action, though accepting attacker-controlled CSS from page content remains a trade-off. Defense in Depth: Extend the rule in to match query parameters within . POC Code Proof of concept: References Original Reference: GHSA-r7fx-8g49-7hhr Fix Commit: 5a12f9be8 Unpatched Code System: system/src/Grav/Common/Traits/MediaObjectTrait.php lines 519-524 Project Security Policy: SECURITY.md (based on the trust boundary severity model) Severity Moderate CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: High - User interaction: Required - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: None CVE ID CVE-2026-53890 Weakness Weakness CWE-79 Contributors @CyberKareem (CyberKareem Finder)

Goal Reached Thanks to every supporter — we hit 100%!

Incomplete patch for Stored CSS Injection in Grav CMS via Markdown style param (GHSA-r7fx-8g49-7hhr)

More from this source