Description

Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts), which substitutes untrusted parameters such as usernames into translation templates before parsing the result as markdown. Grav's server-side username validation (DataUser::isValidUsername) blocks filesystem-dangerous characters but not <, >, ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml()—such as the two-factor force-disable confirmation prompt or the 'page is locked' editor notice—the payload executes in their authenticated session. Fixed in 2.0.21.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T12:17:23.630Z",
  "pubdate": "2026-09-04T12:17:23.630Z",
  "executiveSummary": "Grav Admin (getgrav/grav-plugin-admin2) versions 2.0.19 and earlier are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The flaw originates from improper input sanitization during the processing of translation templates.\nAn attacker can exploit this by registering a malicious username containing HTML or JavaScript payloads. The vulnerability persists because Grav's server-side username validation mechanism, DataUser::isValidUsername, fails to block common XSS-related characters such as <, >, \", or '.\nWhen an administrator accesses UI elements that render the username—specifically the two-factor force-disable confirmation or the page lock notification—the payload is parsed and executed within the administrator's authenticated browser session.\nThis vulnerability allows an attacker to execute arbitrary JavaScript in the context of an administrative session, potentially leading to unauthorized actions, session hijacking, or the modification of site content. Successful exploitation requires an attacker to register an account and subsequently have their username rendered within a vulnerable administrator interface component.",
  "technicalDetails": "The vulnerability resides within the tHtml() function located in src/lib/stores/i18n.svelte.ts. This function is responsible for managing translation templates. The root cause is the insecure concatenation of untrusted user-supplied data (specifically the username) into these translation templates, which are subsequently interpreted and rendered as markdown. Because the rendering process handles the content as markdown, injected HTML tags are parsed and executed by the browser.\nThe exploitation flow begins during the user registration phase. The application employs DataUser::isValidUsername for server-side validation; however, this filter is insufficient as it only restricts characters deemed dangerous for the filesystem rather than those used for XSS. Consequently, an attacker can supply a username consisting of an HTML payload, such as '<script>alert(1)</script>'. The system accepts this as a valid username and persists the payload into the database.\nThe exploitation remains dormant until an administrative user interacts with specific UI components that invoke the vulnerable tHtml() function. When an administrator triggers a scenario where their username is displayed—such as being prompted to force-disable two-factor authentication or viewing a 'page is locked' editor notice—the stored payload is retrieved and processed by tHtml().\nSince the browser renders the output of tHtml() in the context of an active, authenticated administrative session, the JavaScript payload executes with full access to the administrator's permissions, cookies, and sensitive UI elements. This facilitates post-exploitation activities including, but not limited to, unauthorized administrative actions, sensitive data exfiltration, or the further compromise of the Grav installation via the plugin manager or page editor features. The vulnerability is explicitly fixed in version 2.0.21, likely through the implementation of stricter input validation or output encoding to prevent the execution of malicious HTML content."
}