Grav detectXss stored XSS bypass via unpaired quote

Severity: high · CVSS 8.7 · Published 2026-08-18

Grav is a flat-file content management system used to build and manage websites. The vulnerability allows authenticated editors to bypass the XSS detection filter by injecting unquoted HTML attributes with unpaired quotes, enabling them to inject malicious event handlers that execute in visitor browsers when pages are rendered. This could lead to account compromise, credential theft, or malware distribution to website visitors.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.7, published 18 August 2026.
Which products and versions are affected?
Grav before 2.0.15; getgrav/grav (Packagist) < 2.0.15.
Is there a fix for This vulnerability?
A patch was published on 2026: version 2.0.15 patches the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS (CWE-79) in Grav's detectXss() function located in system/src/Grav/Common/Security.php. The on_events regex pattern used to detect event-handler attributes fails when an unpaired quote appears inside an unquoted attribute value, causing the regex to stall and fail to match subsequent event handlers like onerror=. An authenticated editor (non-super admin) can inject payloads such as &lt;img src=x" onerror=alert(1)&gt; which pass validation at save-time but execute in visitor browsers because HTML parsers treat the unpaired quote as a data character and correctly parse the onerror attribute. The attack requires authentication but no user interaction beyond saving content. The vulnerability affects Grav versions before 2.0.15, which is listed as patched.

Affected products

  • Grav Grav before 2.0.15

Timeline

  • 2026-08-18: disclosed
  • 2026: patched: version 2.0.15 patches the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.