DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75828: CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS

#security #cve #cybersecurity

CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS

Vulnerability ID: CVE-2026-75828
CVSS Score: 9.3
Published: 2026-09-17

CVE-2026-75828 is a critical stored cross-site scripting (XSS) vulnerability in the getgrav Grav CMS before version 2.0.15. The vulnerability resides in the detectXss() security filter mechanism, where parser-differential mismatches between the regular-expression-based server-side validation and browser HTML5 tokenization allow authenticated editors to bypass event-handler detection and inject arbitrary JavaScript execution vectors.

TL;DR

A parser-differential flaw in Grav CMS's detectXss() filter allows authenticated editors to bypass event-handler detection using unpaired quotes in unquoted attribute values, resulting in stored cross-site scripting.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Score: 9.3 (Critical)
  • EPSS Score: 0.00343
  • Impact: Stored Cross-Site Scripting (XSS) leading to Session Hijacking / RCE
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Grav CMS
  • grav: < 2.0.15 (Fixed in: 2.0.15)

Code Analysis

Commit: d5f89d9

Fix XSS vulnerability in detectXss() by anchoring quote parsing to assignment operator.

Exploit Details

Mitigation Strategies

  • Upgrade the Grav Core installation to version 2.0.15 or higher.
  • Apply the regex hotfix to system/src/Grav/Common/Security.php to anchor quote matching to the assignment operator.
  • Implement Web Application Firewall (WAF) inspection to reject payload sequences containing malformed HTML tags.

Remediation Steps:

  1. Navigate to the Grav root directory on the hosting server.
  2. Execute the CLI self-upgrade command: bin/gpm self-upgrade
  3. Verify the version in system/src/Grav/Common/Security.php to ensure the updated regex configurations are active.

References

Read the full report for CVE-2026-75828 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)