CVE-2025-46199
Published: 25 July 2025
Summary
CVE-2025-46199 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Getgrav Grav. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the XSS vulnerability by identifying, reporting, and correcting the flaw in vulnerable Grav CMS versions through timely patching.
Enforces validation of user-supplied inputs in form fields to block injection of crafted malicious scripts causing XSS.
Filters and sanitizes information outputs from form processing to prevent execution of injected arbitrary scripts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated network exploitation of a public-facing web application (Grav CMS) via crafted input leading to code execution.
NVD Description
Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields
Deeper analysisAI
CVE-2025-46199 is a Cross-Site Scripting (XSS) vulnerability affecting Grav CMS versions 1.7.48 and earlier. The issue, published on 2025-07-25, allows an attacker to execute arbitrary code by injecting a crafted script into form fields. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical, and is classified under CWE-79.
An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation details are outlined in the following advisories: https://rapid-echo-f9c.notion.site/Grav-XSS-25-04-21-1dcaf8998a078001a2eff3dc47974d6d?pvs=4 and https://tyojong.tistory.com/2.
Details
- CWE(s)