# CVE-2025-66311: Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Source: https://junglewise.ai/threats/cve-2025-66311-this-admin-plugin-for-grav-is-an-html-user-interface-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01  
License: CC BY 4.0 with a link back

CVE-2025-66311 · Severity: medium · CVSS 5.4 · Published 2025-12-01

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface. This vulnerability is fixed in 1.11.0-beta.1.

Technologies: [Getgrav Grav-Plugin-Admin](https://junglewise.ai/threats/technologies/grav-plugin-admin), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-66311 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66311 being exploited in the wild.

**How severe is CVE-2025-66311?** Medium severity, with a CVSS score of 5.4, published 1 December 2025.

**Which products and versions are affected?** getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.11.0-beta.1.

**Is there a fix for CVE-2025-66311?** Yes. getgrav/grav (Packagist): upgrade to 1.11.0-beta.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66311?** Check whether you run Getgrav Grav-Plugin-Admin or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 1.11.0-beta.1 or later

  ```sh
  composer require getgrav/grav:^1.11.0-beta.1
  ```


## Affected products

- Getgrav Grav-Plugin-Admin
- getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=1.11.0-beta.1

## Identifiers

- CVE-2025-66311
- GHSA-mpjj-4688-3fxg

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)