CVE-2026-85600
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Grav Admin (getgrav/grav-plugin-admin2) versions up to 2.0.19 contain a stored XSS vulnerability in the tHtml() function, which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Server-side username validation does not block <, >, " or ', allowing an attacker to register a username with an HTML payload. When an administrator views a UI surface rendering the username through tHtml(), the payload executes in their session. Fixed in 2.0.21.
Risk Assessment
An attacker can execute malicious scripts in an administrator's session, potentially leading to session theft, content modification, or privilege escalation.
Recommendation
Update Grav Admin to version 2.0.21 or later. Additionally, consider strengthening username validation to block HTML characters.
Other vulnerabilities in Grav Admin
Original NVD description (English source)
Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS