What is GHSA-cchq-397m-q2qm?

GHSA-cchq-397m-q2qm is a security advisory published by GitHub Security Advisories with Medium severity. Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor

Which CVE IDs does GHSA-cchq-397m-q2qm cover?

GHSA-cchq-397m-q2qm covers the following CVE IDs: CVE-2025-65186. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cchq-397m-q2qm?

GHSA-cchq-397m-q2qm has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-cchq-397m-q2qm?

GHSA-cchq-397m-q2qm affects 1 product, including: composer/getgrav/grav:\u003c= 1.7.49.

GHSA-cchq-397m-q2qmMediumCVSS 6.1

Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor

Vendor

GitHub Security Advisories

Published

December 2, 2025

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-65186 →

📋 Description

Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.

🎯 Affected products1

composer/getgrav/grav:<= 1.7.49

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-65186
https://github.com/getgrav/grav
https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65186.pdf
https://github.com/advisories/GHSA-cchq-397m-q2qm