CVE-2026-75834: Input Sanitization Bypass leading to Stored XSS in Grav CMS
Vulnerability ID: CVE-2026-75834
CVSS Score: 5.4
Published: 2026-09-17
CVE-2026-75834 is a stored Cross-Site Scripting (XSS) vulnerability in Grav CMS core, caused by a design flaw in its input validation wrapper Security::detectXss(). Regular expressions using the PCRE UTF-8 /u modifier fail-open when encountering invalid UTF-8 sequences or when the PCRE JIT stack limit is exhausted, allowing authenticated users with page-editing privileges to save malicious HTML and scripts.
TL;DR
A critical security bypass in Grav CMS's XSS safety gate allows attackers to inject and store arbitrary HTML/JavaScript by passing invalid UTF-8 bytes or oversized elements, triggering silent engine failures.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network (Authenticated Page-Edit Permissions Required)
- CVSS v3.1 Score: 5.4 (Medium)
- EPSS Score: 0.00182 (0.18% Probability)
- Impact: Stored Cross-Site Scripting (XSS) / Account Takeover
- Exploit Status: Proof of Concept (PoC) documented
- CISA KEV Status: Not listed
Affected Systems
- Grav CMS Core
-
grav: < 2.0.14 (Fixed in:
2.0.14)
Code Analysis
Commit: 5192316
Fix XSS safety gate fail-open condition on PCRE evaluation failures
Mitigation Strategies
- Upgrade core Grav CMS deployment to version 2.0.14 or above
- Apply strict input validation on markdown file writes via WAF filters
- Run server-side sweeps to detect broken encoding formats in site text storage
Remediation Steps:
- Review user directories for modifications executed inside pages containing non-ASCII values
- Update system dependencies and apply commit 5192316f5bf0f033636f43561829d7fc13a4ab64 manually if pinned to an older version
- Enforce multi-factor authentication and role limits for editor-level profiles
References
Read the full report for CVE-2026-75834 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)