Description

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "1.8",
  "pubDate": "2026-09-13T19:16:52.707Z",
  "pubdate": "2026-09-13T19:16:52.707Z",
  "executiveSummary": "Grav version 1.7.50.2 exhibits a vulnerability characterized as stored Cross-Site Scripting (XSS) within the Home Page editor component.\nThe vulnerability allows an authenticated administrator to inject arbitrary JavaScript directly into the page content.\nThe primary impact is the execution of malicious scripts within the context of the administrative session, potentially leading to unauthorized actions, session hijacking, or site-wide configuration changes.\nThe context of this vulnerability is heavily debated, as the administrative role in Grav inherently possesses capabilities to modify templates, install plugins, and manage server-side files, which are considered vectors for full remote code execution.\nExploitation requires high-level administrative privileges, limiting the scope of the vulnerability to threat actors who have already successfully compromised an administrative account.\nFrom a risk management perspective, this finding represents a security configuration consideration rather than a traditional privilege escalation, given the pre-existing authoritative access level of the affected user role.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient sanitization of user-supplied input within the Home Page editor interface of Grav version 1.7.50.2. When an administrative user provides a payload containing JavaScript in the editor field, the application processes and stores this input in the underlying content storage without adequate content filtering or context-aware output encoding.\nThe attack flow initiates when an authenticated administrator navigates to the Home Page editor. By injecting a crafted HTML payload containing script tags or event handlers, the attacker causes the application to save the malicious data to the persistent storage layer. Upon rendering the page within the administrative dashboard or front-end interface, the browser interprets the stored input as executable code.\nThe vulnerable component is the content management editor, which fails to enforce strict input validation policies for administrative users. While this behavior facilitates Stored XSS, it is important to note the architectural context of Grav. As a flat-file CMS, administrative users are granted legitimate access to the server's file system, allowing for the direct modification of twig templates and the installation of third-party plugins. Consequently, an attacker possessing administrative credentials has multiple, more effective avenues for malicious activity, including the execution of PHP code or the installation of backdoors.\nThe impact of the XSS payload is constrained by the privileges of the executing administrator. Since the payload executes within the administrative session, it can perform any action permitted by the UI, including updating site settings, modifying user accounts, or further obfuscating malicious persistence mechanisms. While the vulnerability technically allows for client-side script execution, the security implications are subsumed by the administrative capabilities inherent to the affected user account."
}