Executive brief
A security vulnerability in the Grav CMS Form plugin allows users with 'editor' permissions to execute malicious code in the browsers of site administrators. By adding specially crafted tags or categories to a page, an attacker can trigger this code whenever an administrator views or edits any page in the management panel. This could allow an attacker to perform unauthorized administrative actions, such as creating new users or changing system settings, by hijacking the administrator's active session.
Technical details
A stored XSS vulnerability exists in the Grav CMS Form plugin due to the use of the Twig '|raw' filter in the select field template (select.html.twig). This filter bypasses auto-escaping for taxonomy tag and category values in the admin panel. Because taxonomy options are pooled globally, a malicious value on one page affects all page editor views. Additionally, the vulnerability leverages a bypass of Grav's 'Security::detectXss()' function, where the 'on_events' regex fails to identify unquoted event handlers. Attackers with editor-level privileges can inject payloads that break out of the HTML select context to execute JavaScript. The issue is resolved in Grav Form plugin 9.0.1 and Grav Core 2.0.0-beta.2.
Affected products
- getgrav Grav CMS Form Plugin < 9.0.1
- getgrav Grav CMS Core < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Fixes applied to Form plugin and Grav core branches.
- 2026-05-05: advisory: GitHub Advisory published.