Executive brief
Grav is a flat-file content management system used to build and manage websites. The vulnerability allows authenticated editors to bypass the XSS detection filter by injecting unquoted HTML attributes with unpaired quotes, enabling them to inject malicious event handlers that execute in visitor browsers when pages are rendered. This could lead to account compromise, credential theft, or malware distribution to website visitors.
Technical details
The vulnerability is a stored XSS (CWE-79) in Grav's detectXss() function located in system/src/Grav/Common/Security.php. The on_events regex pattern used to detect event-handler attributes fails when an unpaired quote appears inside an unquoted attribute value, causing the regex to stall and fail to match subsequent event handlers like onerror=. An authenticated editor (non-super admin) can inject payloads such as <img src=x" onerror=alert(1)> which pass validation at save-time but execute in visitor browsers because HTML parsers treat the unpaired quote as a data character and correctly parse the onerror attribute. The attack requires authentication but no user interaction beyond saving content. The vulnerability affects Grav versions before 2.0.15, which is listed as patched.
Affected products
- Grav Grav before 2.0.15
Timeline
- 2026-08-18: disclosed
- 2026: patched: version 2.0.15 patches the vulnerability