Description

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-14T12:16:46.540Z",
  "pubdate": "2026-08-14T12:16:46.540Z",
  "executiveSummary": "Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting (XSS) vulnerability residing in the Security::detectXss() function located at system/src/Grav/Common/Security.php.\nThis vulnerability allows an authenticated page editor lacking admin.super privileges to inject malicious payloads into page content that bypass security filters.\nThe flaw stems from a discrepancy between the sanitization logic and browser parsing behavior when handling quoted attribute values containing closing angle brackets.\nWhen a visitor, including unauthenticated users, views the affected page, the injected payload executes within the context of the site origin.\nThe risk implications include potential session hijacking, data theft, and unauthorized actions performed on behalf of the victim.",
  "technicalDetails": "The vulnerability is caused by an inadequate regular expression implementation within the Security::detectXss() function inside system/src/Grav/Common/Security.php.\nThe event-handler scan is anchored at the opening angle bracket and utilizes the pattern [^>]*?, which incorrectly assumes that scanning cannot cross the first literal closing angle bracket.\nWhen a closing angle bracket appears inside a quoted attribute value, the security detector terminates its scan prematurely, while the web browser continues to keep the tag open.\nThis parser differential allows the browser to interpret and execute a subsequent event handler, such as an onerror attribute, which the sanitization routine failed to detect.\nAn attacker with page editor privileges, specifically lacking admin.super privileges, exploits this flaw by saving crafted page content containing payloads such as <img src=x title=\">\" onerror=alert(document.domain)>.\nThe malicious payload is successfully accepted and stored persistently within the application database or file system.\nUpon retrieval, any victim, including unauthenticated users, loading the page triggers the execution of the payload within the site origin, leading to arbitrary JavaScript execution."
}