Executive brief
A vulnerability in the Grav content management system allows a user with basic page-creation permissions to inject malicious scripts into the website. When an administrator views the affected page, the script can steal sensitive session information and system configuration details. This can be used by an attacker to take full control of the web server and execute unauthorized commands.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Grav Core and the Admin Plugin due to insufficient sanitization in the `detectXss` method within `system/src/Grav/Common/Security.php`. The vulnerability stems from a flawed regular expression used to detect event handlers (`on_events`), which can be bypassed using unquoted attributes (e.g., `<img src=x onload=... >`). Additionally, the default security configuration failed to blacklist dangerous tags like `<svg>` and `<math>`. A low-privileged user with page creation rights can inject these tags to execute arbitrary JavaScript in an administrator's browser. This can be used to exfiltrate the `admin_nonce`, enabling CSRF bypass and subsequent Remote Code Execution (RCE) via administrative endpoints. The issue is addressed in version 2.0.0-beta.2 by tightening the regex and expanding the `security.xss_dangerous_tags` list.
Affected products
- getgrav Grav < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Fix applied to Grav core 2.0 branch.
- 2026-05-05: advisory: Public disclosure of GHSA-w8cg-7jcj-4vv2.