Executive brief
Grav, a popular open-source flat-file CMS, has a flaw in its XSS detection mechanism that allows authenticated content editors to inject stored XSS payloads that execute in the browsers of all visitors, including site administrators. An attacker with editor privileges can craft malicious HTML with event handlers (like onerror) preceded by unpaired quotes that the detector misses, bypassing content validation at save time. The injected scripts run with the site's privileges, enabling session hijacking, account takeover, and malware distribution to all users.
Technical details
The vulnerability is a logic error in Grav's `detectXss()` function (Security.php:290) in the `on_events` regex pattern used to detect event-handler attributes. The regex treats any quote character as a string delimiter, but HTML only enters a quoted-value state when a quote appears immediately after `=`. An unpaired quote inside an unquoted attribute value causes the regex to enter an "unterminated string" state from which it cannot advance, allowing a following event handler (e.g., `onerror=`) to be overlooked. Payloads like `<img src=x" onerror=alert(1)>` are stored verbatim in the database because `checkSafety()` at save time (the only XSS guard for non-super editors) relies entirely on `detectXss()`. The injected content is emitted via Twig's `raw` filter and rendered in all visitors' browsers without further validation.
Affected products
- Getgrav Grav 2.0.13 and likely earlier versions
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-75828 assigned