GHSA-FFMG-HFVG-JHG9

Vulnerability from github – Published: 2026-09-16 22:14 – Updated: 2026-09-16 22:14
VLAI
Summary
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Details

Summary

Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute() fallbacks, but the adjacent resize() action still writes caller-controlled values directly into styleAttributes.

A publisher who can edit page Markdown can store a crafted image URL that renders additional CSS declarations in the final <img style=...> attribute. This crosses the same lower-privileged publisher to higher-privileged reviewer/admin rendered-content boundary as the earlier media style and attribute advisories.

Impact

A lower-privileged content editor can persist CSS declarations that are rendered when a higher-privileged user views the page or admin preview. The demonstrated payload creates a full-viewport fixed overlay by injecting position:fixed, viewport dimensions, background color, and z-index declarations.

This does not require JavaScript execution. The impact is stored CSS injection in rendered content, with UI redress/overlay and content-manipulation risk in higher-privileged sessions.

Reproduction

Tested versions:

  • Grav 2.0 branch commit 6582166173bb8eb5869d96aea384e0e73777c94c
  • Grav 2.0.0-rc.9 commit e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8

Minimal Markdown payload:

![logo](image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200)

A minimal PHPUnit-style reproducer can drive the same parser path directly:

$m = new class {
    use \Grav\Common\Media\Traits\MediaObjectTrait;
    use \Grav\Common\Media\Traits\StaticResizeTrait;

    public function addMetaFile($filepath) {}
    public function __toString(): string { return ''; }
    public function url($reset = true) { return '/img.png'; }
    public function get($name, mixed $default = null, $separator = null) { return $default; }
    public function set($name, mixed $value, $separator = null) { return $this; }
    protected function createThumbnail($thumb) { return null; }
    protected function createLink(array $attributes) { return null; }
    protected function getItems(): array { return []; }
};

$excerpts = new \Grav\Common\Page\Markdown\Excerpts(null, ['markdown' => [], 'images' => []]);
$m = $excerpts->processMediaActions(
    $m,
    'image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200'
);
$element = $m->parsedownElement('', '', '', '', false);
var_dump($element['attributes']['style']);

Observed style attribute:

width: 100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999px;height: 200px;

The appended px lands on the final z-index value, but the preceding injected declarations remain syntactically valid CSS.

Root Cause / Technical Details

system/src/Grav/Common/Page/Markdown/Excerpts.php::processMediaActions() parses the image query string into media actions and invokes the requested public media method with call_user_func_array([$medium, $action['method']], $args).

For resize(), system/src/Grav/Common/Media/Traits/StaticResizeTrait.php::resize() stores width and height directly into style attributes:

$this->styleAttributes['width'] = $width . 'px';
$this->styleAttributes['height'] = $height . 'px';

It does not verify that the values are numeric, length-only, or free of CSS declaration delimiters. Later, system/src/Grav/Common/Media/Traits/MediaObjectTrait.php::parsedownElement() serializes keyed style attributes as raw CSS declarations:

$style .= $key . ': ' . $value . ';';

The sanitizer added for direct style() inputs is not reached for values introduced by resize(). As a result, resize=100;position:fixed;...,200 breaks out of the intended width: value and injects additional declarations.

PoC Evidence

On both current 2.0 and 2.0.0-rc.9, the targeted regression test produced the injected style string above. Existing tests still confirm the direct style() and attribute() paths are rejected; the bypass is specific to the adjacent resize() styleAttributes path.

Remediation

Sanitize or type-normalize all values before they enter styleAttributes, not only values passed through MediaObjectTrait::style(). For resize(), cast or validate width and height as numeric values before appending px, or use a shared CSS declaration builder that rejects semicolons, colons, property names, and other declaration-breaking characters. Add regression coverage for resize=100;position:fixed;top:0,200 and any other media action that writes to styleAttributes directly.

Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-rc.9"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0-rc.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-58657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T22:14:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGrav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct `?style=` payloads and unsafe `attribute()` fallbacks, but the adjacent `resize()` action still writes caller-controlled values directly into `styleAttributes`.\n\nA publisher who can edit page Markdown can store a crafted image URL that renders additional CSS declarations in the final `\u003cimg style=...\u003e` attribute. This crosses the same lower-privileged publisher to higher-privileged reviewer/admin rendered-content boundary as the earlier media style and attribute advisories.\n\n## Impact\n\nA lower-privileged content editor can persist CSS declarations that are rendered when a higher-privileged user views the page or admin preview. The demonstrated payload creates a full-viewport fixed overlay by injecting `position:fixed`, viewport dimensions, background color, and z-index declarations.\n\nThis does not require JavaScript execution. The impact is stored CSS injection in rendered content, with UI redress/overlay and content-manipulation risk in higher-privileged sessions.\n\n## Reproduction\n\nTested versions:\n\n- Grav 2.0 branch commit `6582166173bb8eb5869d96aea384e0e73777c94c`\n- Grav `2.0.0-rc.9` commit `e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8`\n\nMinimal Markdown payload:\n\n```markdown\n![logo](image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200)\n```\n\nA minimal PHPUnit-style reproducer can drive the same parser path directly:\n\n```php\n$m = new class {\n    use \\Grav\\Common\\Media\\Traits\\MediaObjectTrait;\n    use \\Grav\\Common\\Media\\Traits\\StaticResizeTrait;\n\n    public function addMetaFile($filepath) {}\n    public function __toString(): string { return \u0027\u0027; }\n    public function url($reset = true) { return \u0027/img.png\u0027; }\n    public function get($name, mixed $default = null, $separator = null) { return $default; }\n    public function set($name, mixed $value, $separator = null) { return $this; }\n    protected function createThumbnail($thumb) { return null; }\n    protected function createLink(array $attributes) { return null; }\n    protected function getItems(): array { return []; }\n};\n\n$excerpts = new \\Grav\\Common\\Page\\Markdown\\Excerpts(null, [\u0027markdown\u0027 =\u003e [], \u0027images\u0027 =\u003e []]);\n$m = $excerpts-\u003eprocessMediaActions(\n    $m,\n    \u0027image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200\u0027\n);\n$element = $m-\u003eparsedownElement(\u0027\u0027, \u0027\u0027, \u0027\u0027, \u0027\u0027, false);\nvar_dump($element[\u0027attributes\u0027][\u0027style\u0027]);\n```\n\nObserved style attribute:\n\n```text\nwidth: 100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999px;height: 200px;\n```\n\nThe appended `px` lands on the final `z-index` value, but the preceding injected declarations remain syntactically valid CSS.\n\n## Root Cause / Technical Details\n\n`system/src/Grav/Common/Page/Markdown/Excerpts.php::processMediaActions()` parses the image query string into media actions and invokes the requested public media method with `call_user_func_array([$medium, $action[\u0027method\u0027]], $args)`.\n\nFor `resize()`, `system/src/Grav/Common/Media/Traits/StaticResizeTrait.php::resize()` stores width and height directly into style attributes:\n\n```php\n$this-\u003estyleAttributes[\u0027width\u0027] = $width . \u0027px\u0027;\n$this-\u003estyleAttributes[\u0027height\u0027] = $height . \u0027px\u0027;\n```\n\nIt does not verify that the values are numeric, length-only, or free of CSS declaration delimiters. Later, `system/src/Grav/Common/Media/Traits/MediaObjectTrait.php::parsedownElement()` serializes keyed style attributes as raw CSS declarations:\n\n```php\n$style .= $key . \u0027: \u0027 . $value . \u0027;\u0027;\n```\n\nThe sanitizer added for direct `style()` inputs is not reached for values introduced by `resize()`. As a result, `resize=100;position:fixed;...,200` breaks out of the intended `width:` value and injects additional declarations.\n\n## PoC Evidence\n\nOn both current 2.0 and 2.0.0-rc.9, the targeted regression test produced the injected style string above. Existing tests still confirm the direct `style()` and `attribute()` paths are rejected; the bypass is specific to the adjacent `resize()` styleAttributes path.\n\n## Remediation\n\nSanitize or type-normalize all values before they enter `styleAttributes`, not only values passed through `MediaObjectTrait::style()`. For `resize()`, cast or validate width and height as numeric values before appending `px`, or use a shared CSS declaration builder that rejects semicolons, colons, property names, and other declaration-breaking characters. Add regression coverage for `resize=100;position:fixed;top:0,200` and any other media action that writes to `styleAttributes` directly.",
  "id": "GHSA-ffmg-hfvg-jhg9",
  "modified": "2026-09-16T22:14:53Z",
  "published": "2026-09-16T22:14:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58657"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/6582166173bb8eb5869d96aea384e0e73777c94c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-stored-css-injection-via-markdown-image-resize-action"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.