What is CVE-2025-64059?

CVE-2025-64059 is a low-severity vulnerability in Getgrav Grav, classified under Cross-site Scripting. CVSS score: 1.8/10. Published 2026-09-13.

How severe is CVE-2025-64059?

Low severity. CVSS v3 base score is 1.8 out of 10.

XSS in Getgrav Grav

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (14.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 1.8 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N.

Affected products

Getgrav Grav — versions 1.7.50.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org

Frequently asked questions

What is CVE-2025-64059?: CVE-2025-64059 is a low-severity vulnerability in Getgrav Grav, classified under Cross-site Scripting. CVSS score: 1.8/10. Published 2026-09-13.
How severe is CVE-2025-64059?: Low severity. CVSS v3 base score is 1.8 out of 10.