Executive brief
Grav is a flat-file content management system used to publish websites. A vulnerability in versions before 2.0.20 allows page editors to inject malicious scripts that execute for all site visitors, including administrators. Attackers can exploit this to steal administrator credentials and gain full control of the website.
Technical details
Grav 2.0's Twig content sandbox allowlists the addJs and addCss methods on Grav\Common\Assets without proper output escaping. A page editor with minimal privileges can call these methods to register arbitrary assets; the theme then emits them into the document head as <script> or <link> tags with unescaped URLs, allowing attribute breakout. The vulnerability bypasses the save-time XSS scanner because asset registration mutates a shared service and returns only a key, producing no markup for detection. Exploitation requires only page-edit rights and results in persistent script execution on the attacker's origin for all visitors, including administrators whose localStorage-stored JWT tokens can be exfiltrated for portable super-admin API access. Grav 2.0.20 removes addJs and addCss from the sandbox allowlist, and HTML-escapes asset URLs at all render sites; sites needing this functionality can re-add the methods via security.yaml configuration.
Affected products
- Getgrav Grav before 2.0.20
Timeline
- 2026-08-21: disclosed: Security advisory published on GitHub
- 2026-09-05: patched: Fix released in Grav 2.0.20
- 2026-09-05: advisory: CVE-2026-86197 assigned and published to NVD