Executive brief
Grav is a flat-file CMS that allows content editors to save pages. A flaw in the XSS detection logic permits editors without admin privileges to inject event handlers inside quoted HTML attributes, which are then executed when visitors view the page. This allows attackers to steal visitor data, hijack sessions, or perform actions on behalf of site users.
Technical details
The vulnerability is a stored XSS in Grav's Security::detectXss() function (system/src/Grav/Common/Security.php:253), which uses a regex pattern anchored at `<` with a non-greedy match `[^>]*?` to scan for event handlers. This pattern fails when a `>` character appears inside a quoted attribute value, because the regex terminates at the first `>` while the HTML parser treats the tag as still open. An attacker with `admin.login` and `admin.pages` permissions (but not `admin.super`) can save malicious page content like `<img src=x title=">" onerror=alert(1)>`, which bypasses the detector but executes in the browser. The AdminController::savePage() endpoint relies solely on this flawed detector for XSS validation, allowing the payload to be stored and executed on every page view by any visitor.
Affected products
- Grav Grav 2.0.11 and likely earlier versions
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-72832 assigned