61 matches found
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media actions. The prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the adjacent resize action still writes caller-controlled values directly into...
4.8CVSS0.00371EPSS
SaveExploits0References6Affected Software1
20