CVE-2026-75834: Grav stored XSS via invalid UTF-8 byte in Security::detectXss()

CVE-2026-75834 · Severity: medium · CVSS 5.4 · Published 2026-08-18

Grav is a file-based CMS used to build and manage websites. A publisher-level account can inject invalid UTF-8 bytes into page content to bypass the XSS safety checks, allowing malicious JavaScript to be stored and executed in the browsers of all visitors—including administrators—when they view the affected page. This bypasses a critical content validation gate and creates a privilege escalation from publisher to admin-level capability.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-75834 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75834 being exploited in the wild.
How severe is CVE-2026-75834?
Medium severity, with a CVSS score of 5.4, published 18 August 2026.
Which products and versions are affected?
Grav 2.0.13 and possibly earlier; getgrav/grav (Packagist) < 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.14.
Is there a fix for CVE-2026-75834?
Yes. getgrav/grav (Packagist): upgrade to 2.0.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75834 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-75834?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.14 or later
    composer require getgrav/grav:^2.0.14

Technical details

The vulnerability is a stored XSS (CWE-79) rooted in improper input validation (CWE-20) of the Security::detectXss() function in system/src/Grav/Common/Security.php. All six regex patterns in the function use the PCRE /u (UTF-8) modifier; when preg_match() encounters even a single invalid UTF-8 byte in the input string, it returns false for the entire call rather than evaluating the pattern, causing the XSS detection to silently fail. This happens independently of regex logic and affects all patterns uniformly. An authenticated publisher without super-admin rights can craft page content containing a raw invalid UTF-8 byte followed by an XSS payload (e.g., "\x80&lt;img src=x onerror=alert(1)&gt;"), which bypasses Validation::checkSafety() at save time and stores the payload unmodified. Browsers render the intact payload normally by substituting the invalid byte with a U+FFFD replacement character, allowing the JavaScript to execute in any visitor's session. The recommended fix validates UTF-8 encoding upfront using mb_check_encoding() before regex evaluation.

Affected products

  • Grav Grav 2.0.13 and possibly earlier

Identifiers

  • CVE-2026-75834
  • GHSA-q2j8-x8hf-63ch

Timeline

  • 2026-09-17: disclosed
  • other: CVE-2026-75834 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.