Description

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-26T14:16:51.133Z",
  "pubdate": "2026-09-26T14:16:51.133Z",
  "executiveSummary": "The Grav Data Manager plugin (versions 1.0.1 through 1.4.4) contains a critical Stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from the improper handling of user-supplied data within the admin panel's item-detail view.\nBy submitting malicious payloads via front-end forms, an unauthenticated attacker can inject arbitrary HTML and JavaScript into stored data entries. When an administrator views these records within the classic Grav admin interface, the payload executes within the victim's session.\nThis vulnerability allows attackers to hijack administrator sessions, perform unauthorized actions on behalf of the administrator, or access sensitive data protected by CSRF tokens. While the issue is limited to the classic admin panel and does not affect the Grav 2.0 Admin Next interface, it poses a significant risk to the integrity and confidentiality of the administrative backend. Successful exploitation requires no interaction for certain field types, such as checkbox or multi-select inputs, making it a high-risk vector for malicious actors targeting Grav-based websites.",
  "technicalDetails": "The vulnerability is located in the file 'admin/templates/partials/item.html.twig' of the Grav Data Manager plugin. The root cause is the improper sanitization and subsequent rendering of stored data entries. The application employs the Twig 'raw' filter to output content without adequate contextual encoding, which effectively bypasses the platform's default security mechanisms against Cross-Site Scripting.\nFurthermore, the plugin utilizes a 'striptags('<br>')' call intended to sanitize inputs; however, this approach is fundamentally flawed as PHP's 'strip_tags()' function preserves allowed tags along with any attributes contained within them. An attacker can leverage this behavior to inject malicious HTML attributes—such as 'onmouseover' or other event handlers—to facilitate JavaScript execution. Because the system renders this data via the 'raw' filter, the injected tags and event handlers are parsed and executed by the administrator's browser.\nThe attack flow proceeds as follows: First, an unauthenticated attacker submits a payload via a public-facing form managed by the plugin. The payload is subsequently persisted in the 'user/data' directory. Second, an administrative user navigates to the classic Grav admin panel and opens the item-detail view for the affected entry. Finally, the browser interprets the unsanitized input as valid markup, triggering the malicious script.\nFor list-based inputs (e.g., multi-select or checkbox values), the execution is automatic upon loading the page, as these elements are rendered directly. For standard text fields, execution is triggered via interaction, such as a hover event. In both scenarios, the injected code executes within the origin of the admin panel, granting the attacker the full privileges of the logged-in administrator. This includes the ability to perform administrative functions, modify site configuration, or bypass CSRF protections since the script runs within the trusted context of the active administrative session.\nThe vulnerability affects Data Manager versions 1.0.1 through 1.4.4. Sites utilizing the legacy classic admin interface are exposed, whereas those migrated to the Grav 2.0 Admin Next interface remain secure due to the implementation of a separate, correctly escaping rendering path."
}