DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-8HGV-XC77-JMCR: GHSA-8HGV-XC77-JMCR: Privilege Escalation to Super-Admin via Twig Sandbox Escape and Stored XSS in Grav CMS Assets

#security #cve #cybersecurity #ghsa

GHSA-8HGV-XC77-JMCR: Privilege Escalation to Super-Admin via Twig Sandbox Escape and Stored XSS in Grav CMS Assets

Vulnerability ID: GHSA-8HGV-XC77-JMCR
CVSS Score: 9.0
Published: 2026-08-21

An overly permissive default configuration in the Grav CMS Twig sandbox combined with a lack of neutralization of double-quote characters in the Asset rendering engine allows low-privileged page editors to inject malicious JavaScript into administrative contexts. This leads to a stored cross-site scripting (XSS) condition that compromises the sessions of super-administrators, facilitating complete privilege escalation.

TL;DR

A privilege escalation vulnerability in Grav CMS allows page editors to execute arbitrary client-side script code in administrative contexts. By combining a permissive Twig sandbox allowlist with attribute breakout in asset rendering, attackers can steal JWT tokens or create rogue administrative accounts.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 9.0 (Critical)
  • Exploit Maturity: PoC (Proof of Concept)
  • KEV Status: Not Listed
  • Affected Versions: < 2.0.20

Affected Systems

  • Grav CMS
  • Grav CMS: < 2.0.20 (Fixed in: 2.0.20)

Code Analysis

Commit: a4e8c4b

Fix escape asset urls and tweak sandbox default configuration

--- a/system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php
+++ b/system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php
-            ['class' => 'Grav\\Common\\Assets', 'methods' => '__tostring, addcss, addjs'],
+            ['class' => 'Grav\\Common\\Assets', 'methods' => '__tostring'],
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade to Grav CMS version 2.0.20 or above.
  • Remove addjs and addcss from the Twig Sandbox allowlist in system/config/security.yaml or user/config/security.yaml.
  • Restrain page editing permissions to trusted users to reduce the attack surface.

Remediation Steps:

  1. Check the running Grav version using the administrative dashboard or via the command-line utility: 'bin/gpm index'.
  2. If the version is prior to 2.0.20, initiate the update using 'bin/gpm selfupgrade'.
  3. Confirm that 'system/src/Grav/Common/Twig/Sandbox/SandboxDefaults.php' no longer allows 'addjs' or 'addcss' for the Assets class.
  4. Verify that the asset rendering output now uses the escapeAssetUrl function to encode double-quote characters.

References

Read the full report for GHSA-8HGV-XC77-JMCR on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)