Executive brief
Grav, a popular open-source content management system, contains a security flaw in its administrative page editor. A user who already has permission to edit pages could inject malicious scripts that target other administrators. If successful, this could allow an attacker to take over administrative accounts, install unauthorized plugins, and ultimately gain full control over the underlying web server.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Grav CMS versions prior to 1.6.30 within the Admin plugin's page editor. The root cause is an insecure default security configuration that fails to properly neutralize input during page generation (CWE-79). An authenticated attacker with page-editing privileges can inject malicious scripts that execute in the context of other administrative users. This can be leveraged to perform actions on behalf of a higher-privileged administrator, such as installing malicious plugins to achieve remote code execution (RCE) and full system access. The vulnerability is mitigated in version 1.6.30.
Affected products
- Grav Grav < 1.6.30
Timeline
- 2020-12-10: advisory: Initial GitHub Security Advisory published
- 2020-12-10: patched: Fixed in version 1.6.30
- 2026-06-25: disclosed: CVE record published to NVD