Description

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-04T12:17:23.340Z",
  "pubdate": "2026-09-04T12:17:23.340Z",
  "executiveSummary": "Grav versions 2.0.0 through 2.0.17 contain a stored Cross-Site Scripting (XSS) vulnerability residing within the modular page processing logic.\nThe vulnerability allows an authenticated user with page-editing privileges to inject malicious Twig templates into modular pages.\nBecause the application fails to perform save-time XSS detection on these modular components, the injected code is stored persistently within the Grav page structure.\nWhen a victim, including high-privilege administrators, views the parent page that incorporates the compromised modular component, the malicious Twig payload is executed within the context of their browser session.\nThis represents a significant security risk, as successful exploitation enables the execution of arbitrary JavaScript, potentially leading to session hijacking, unauthorized administrative actions, or defacement.\nExploitation requires authenticated access to the Grav page management interface; however, once established, the attack vector is passive, triggering automatically upon victim interaction with the affected page.\nThe scope of impact is limited to the web application's origin but allows for lateral movement within the administrative session context.",
  "technicalDetails": "The root cause of this vulnerability is an inconsistency in the security validation pipeline of Grav's CMS engine specifically concerning modular page types. While standard pages undergo rigorous XSS filtering during the save process, this validation mechanism is bypassed for modular pages within the 2.0.0-2.0.17 release range.\nGrav utilizes the Twig templating engine to render dynamic content. The vulnerability stems from the application's failure to sanitize or neutralize malicious Twig expressions or raw HTML/JavaScript injected into modular page files before they are serialized and stored on the server.\nThe attack flow proceeds as follows: First, an authenticated attacker with page-edit permissions accesses the Grav administration panel or file manager. The attacker creates or modifies a modular page component to include a malicious payload, such as a script tag or a Twig-based execution construct designed to circumvent template restrictions.\nSecond, the application processes this input without applying the standard XSS detection filters, allowing the payload to persist in the filesystem. Because modular pages are dynamically rendered when the parent page is invoked, the malicious payload is subsequently parsed and executed by the server's template engine during the rendering phase.\nThird, when a legitimate user or administrator navigates to the parent page, the server renders the modular component, embedding the attacker’s malicious code directly into the victim's browser response. The payload then executes within the origin of the Grav instance.\nThe post-exploitation impact is severe, particularly when the victim is an administrator. By executing script in the administrator's context, an attacker can bypass CSRF tokens to perform unauthorized administrative operations, steal session cookies, capture sensitive form data, or redirect traffic. This effectively allows an attacker with page-edit privileges to escalate their control over the Grav installation by manipulating the administrative session."
}