Description

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to return false for every pattern, silently bypassing the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions (without the security.xss_whitelist privilege) can store malicious JavaScript that executes in the browser of a visitor who views the affected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T12:19:33.513Z",
  "pubdate": "2026-08-18T12:19:33.513Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists in Grav before 2.0.14 within the Security::detectXss() function located in system/src/Grav/Common/Security.php.\nThe vulnerability allows an authenticated attacker with page-edit permissions, lacking the security.xss_whitelist privilege, to bypass save-time XSS safety gates implemented by Validation::checkSafety().\nThe flaw stems from the implementation of PCRE /u (UTF-8) modifiers across all XSS detection regular expression patterns. When a single invalid UTF-8 byte is introduced anywhere within the page content, the underlying preg_match() execution fails and returns false for every defined validation pattern.\nConsequently, the security validation mechanism is silently bypassed, enabling the persistent storage of malicious JavaScript payloads.\nWhen unsuspecting visitors render the affected page, the injected script executes within the context of their browser sessions, leading to potential session hijacking, unauthorized actions, or further compromise.\nExploitation requires authenticated access with page-edit privileges but circumvents restrictions intended to prevent unauthorized script injection.",
  "technicalDetails": "The vulnerability resides in the Security::detectXss() function implemented within system/src/Grav/Common/Security.php in Grav before 2.0.14.\nThe root cause of the validation bypass is the utilization of the PCRE /u (UTF-8) modifier across all regular expression patterns utilized for XSS detection.\nDuring the save-time safety validation phase executed by Validation::checkSafety(), the presence of a single invalid UTF-8 byte within the submitted page content causes the PHP PCRE engine to halt matching and return false for the preg_match() function.\nBecause preg_match() returns false on compilation or matching errors involving invalid UTF-8 sequences rather than successfully evaluating the sanitization patterns, the security check fails to detect malicious strings and prematurely greenlights the payload.\nAn authenticated attacker possessing page-edit permissions—specifically without the security.xss_whitelist privilege—can craft a payload containing both an invalid UTF-8 byte sequence and arbitrary malicious JavaScript.\nThe attack flow proceeds as follows: First, the attacker authenticates to the application with permissions to edit page content. Second, the attacker crafts an HTTP request submitting page content that embeds an invalid UTF-8 byte alongside malicious JavaScript. Third, the application processes the submission via Validation::checkSafety(), which invokes Security::detectXss(). Fourth, the inclusion of the invalid UTF-8 byte causes all regular expression checks utilizing the /u modifier to fail silently via preg_match(). Fifth, the content is validated as safe and persistently stored in the backend data store. Sixth, when a victimized user requests and renders the affected page, the malicious JavaScript executes in the victim's browser session, yielding stored cross-site scripting execution."
}