Executive brief
Grav is a flat-file content management system used to build and manage websites. Versions 2.0.0 through 2.0.17 contain a stored cross-site scripting vulnerability in modular pages that allows authenticated editors with page-edit rights to inject malicious Twig code that executes when the page is viewed—including in administrator browsers. This could allow an attacker to steal credentials, deface content, or perform unauthorized actions on behalf of site visitors.
Technical details
The vulnerability is a stored XSS flaw in Grav's save-time XSS detection logic. Grav implements a Security::detectXssInEditorContent() guard that renders page content through a sandboxed Twig processor to detect render-time-assembled XSS payloads before save. However, this guard explicitly skips validation for modular pages (pages with slugs beginning with underscore), while the render-time code path unconditionally processes Twig in modular pages regardless of the security.twig_content.process_enabled gate. This asymmetry allows an attacker to create a modular subpage with Twig code that concatenates dangerous attributes (e.g., "on" ~ "error=alert(1)") to evade literal-source validation, then executes when the parent page renders the module. Exploitation requires page-edit rights but no additional privileges; modular pages are a standard product feature. The vulnerability was patched in version 2.0.18.
Affected products
- Getgrav Grav 2.0.0 through 2.0.17
Timeline
- 2026-08-20: disclosed
- 2026-09-04: advisory
- 2026-09-04: patched: Version 2.0.18 released