Description

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T12:19:32.690Z",
  "pubdate": "2026-08-18T12:19:32.690Z",
  "executiveSummary": "An authenticated stored cross-site scripting vulnerability exists within Grav before 2.0.15. The flaw resides in the input sanitization mechanism handled by the detectXss() function. Due to inadequate parsing of unpaired quotes within unquoted attribute values, malicious input successfully bypasses the intended security controls and evades event-handler detection.\nAuthenticated users holding editor privileges can exploit this weakness by injecting arbitrary event handlers, such as onerror=, into page content. When the rendered page is subsequently loaded by site visitors, the injected payloads execute within the context of the victim browser session. This enables unauthorized script execution, session hijacking, or defacement of the affected web application.\nExploitation of this vulnerability requires authenticated access with editor-level privileges to input malicious content that gets stored in the system. The risk implication is significant as it compromises the integrity of rendered web pages and exposes site visitors to client-side attacks.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the detectXss() function within Grav before 2.0.15. Input sanitization routines designed to filter malicious cross-site scripting vectors fail to correctly analyze and normalize unpaired quotes utilized in unquoted attribute values. This parsing discrepancy allows crafted payloads to slip past the security filter validation checks without triggering detection.\nAttackers possessing authenticated editor privileges can inject arbitrary HTML attributes and event handlers, including payloads such as onerror=, directly into editable page content. Because the validation logic does not account for the specific handling of unpaired quotes surrounding or within unquoted attributes, the malicious content is accepted and persistently stored in the backend database or file structure.\nDuring the standard application request flow, when a visitor requests the compromised page, the server retrieves and renders the stored content. The browser parses the malicious markup containing the injected event handlers. Upon rendering, the payload executes in the context of the victim browser, enabling the attacker to perform actions on behalf of the user, steal session cookies, or manipulate the Document Object Model of the application.\nThe attack vector requires network exposure via the web interface, authenticated editor privileges to supply the payload, and victim interaction through the rendering of the poisoned page content in a web browser."
}