GHSA-4WJ4-79RR-PVFF Duplicate Advisory: Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ffmg-hfvg-jhg9. This link is maintained to preserve external references. Original Description Grav before 2.0.0 affected through 2.0.0-rc.9 and the 2.0 branch contains a stored CSS injection vulnerability in the...

CVE-2026-58657: Improper Neutralization of Input During Web Page Generation

Grav before 2.0.0 affected through 2.0.0-rc.9 and the 2.0 branch contains a stored CSS injection vulnerability in the Markdown image resize media action. Prior media hardening rejects direct ?style= payloads and unsafe attribute fallbacks, but the resize action in Excerpts::processMediaActions...