# CVE-2026-75834: Grav stored XSS via invalid UTF-8 byte in Security::detectXss()

Source: https://junglewise.ai/threats/cve-2026-75834-grav-stored-xss-via-invalid-utf-8-byte-in-security-detectxss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75834 · Severity: medium · CVSS 5.4 · Published 2026-08-18

Grav is a file-based CMS used to build and manage websites. A publisher-level account can inject invalid UTF-8 bytes into page content to bypass the XSS safety checks, allowing malicious JavaScript to be stored and executed in the browsers of all visitors—including administrators—when they view the affected page. This bypasses a critical content validation gate and creates a privilege escalation from publisher to admin-level capability.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-75834 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75834 being exploited in the wild.

**How severe is CVE-2026-75834?** Medium severity, with a CVSS score of 5.4, published 18 August 2026.

**Which products and versions are affected?** Grav 2.0.13 and possibly earlier; getgrav/grav (Packagist) < 2.0.14, ECOSYSTEM:introduced=0,fixed=2.0.14.

**Is there a fix for CVE-2026-75834?** Yes. getgrav/grav (Packagist): upgrade to 2.0.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75834 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75834?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.14 or later

  ```sh
  composer require getgrav/grav:^2.0.14
  ```


## Technical details

The vulnerability is a stored XSS (CWE-79) rooted in improper input validation (CWE-20) of the Security::detectXss() function in system/src/Grav/Common/Security.php. All six regex patterns in the function use the PCRE /u (UTF-8) modifier; when preg_match() encounters even a single invalid UTF-8 byte in the input string, it returns false for the entire call rather than evaluating the pattern, causing the XSS detection to silently fail. This happens independently of regex logic and affects all patterns uniformly. An authenticated publisher without super-admin rights can craft page content containing a raw invalid UTF-8 byte followed by an XSS payload (e.g., "\x80&lt;img src=x onerror=alert(1)&gt;"), which bypasses Validation::checkSafety() at save time and stores the payload unmodified. Browsers render the intact payload normally by substituting the invalid byte with a U+FFFD replacement character, allowing the JavaScript to execute in any visitor's session. The recommended fix validates UTF-8 encoding upfront using mb_check_encoding() before regex evaluation.

## Affected products

- Grav Grav 2.0.13 and possibly earlier

## Identifiers

- CVE-2026-75834
- GHSA-q2j8-x8hf-63ch

## Timeline

- 2026-09-17: disclosed
- other: CVE-2026-75834 assigned

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)