CVE-2025-64059 Overview
CVE-2025-64059 affects Grav 1.7.50.2, a flat-file content management system (CMS) written in PHP. The vulnerability allows authenticated administrators to inject JavaScript through the Home Page editor, resulting in stored cross-site scripting (XSS) [CWE-79]. The relevance of this issue is disputed because Grav administrators already possess capabilities to modify templates, install plugins, and upload executable content by design. The attack requires local access, high privileges, and user interaction, which limits practical exploitability.
Critical Impact
An authenticated administrator can store JavaScript payloads through the Home Page editor that execute in the browsers of other administrative users viewing the affected content.
Affected Products
- Grav CMS version 1.7.50.2
- Grav Admin panel Home Page editor component
- Deployments exposing the administrative interface to multiple users
Discovery Timeline
- 2026-09-13 - CVE-2025-64059 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2025-64059
Vulnerability Analysis
The vulnerability resides in the Home Page editor of the Grav administration interface. Grav 1.7.50.2 accepts JavaScript entered by administrators and stores it within page content without sanitization. When another administrator loads the affected page, the stored script executes in the context of the administrative session.
The issue is classified as Improper Neutralization of Input During Web Page Generation [CWE-79]. It represents a stored XSS pattern where persistence in the content store creates the payload delivery mechanism. The disputed nature of this finding reflects Grav's design: administrators can already install arbitrary plugins and edit templates, both of which provide code execution paths that exceed the impact of stored JavaScript.
Root Cause
The Home Page editor does not neutralize HTML or JavaScript submitted by authenticated administrative users. Content saved through the editor is rendered back to page viewers without output encoding, allowing <script> tags and inline event handlers to execute.
Attack Vector
An attacker requires an authenticated administrator account and local access to the administrative interface. The attacker submits a page containing JavaScript through the Home Page editor. A second administrator viewing the modified page triggers execution of the payload within their browser session, exposing session tokens or enabling actions performed as that user.
No verified proof-of-concept code is available. See the external reference document for reporter-supplied details.
Detection Methods for CVE-2025-64059
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or DOM event handlers such as onerror and onload embedded in Grav page content files under user/pages/
- Administrative sessions performing unexpected privileged actions shortly after loading the Home Page
- New or modified Markdown or Twig files containing HTML script constructs authored by administrative accounts
Detection Strategies
- Audit Grav page content stored on disk for HTML script tags and inline event handlers that should not appear in normal Markdown content
- Monitor administrative panel access logs for edits to the Home Page followed by logins from other administrators
- Compare current page content against version-controlled baselines to identify unauthorized additions of executable markup
Monitoring Recommendations
- Enable web server access logging for /admin endpoints and forward events to a centralized logging platform for review
- Alert on modifications to files under user/pages/ performed outside expected change windows
- Track browser Content Security Policy (CSP) violation reports if CSP headers are deployed in front of the Grav admin interface
How to Mitigate CVE-2025-64059
Immediate Actions Required
- Restrict administrative access to trusted personnel only and remove unused administrator accounts from the Grav installation
- Review existing page content, particularly the Home Page, for unauthorized JavaScript and remove any injected payloads
- Require multi-factor authentication (MFA) for the administrative panel to limit account compromise scenarios
Patch Information
No vendor patch information is referenced in the enriched CVE data. Because the issue is disputed on the basis that administrators already hold privileges equivalent to code execution, a security fix may not be issued. Monitor the Grav project references and the Grav GitHub repository for updates.
Workarounds
- Deploy a strict Content Security Policy on the /admin route to block inline scripts and reduce stored XSS impact
- Limit the number of accounts assigned the administrator role and separate content editor duties into lower-privileged roles
- Place the administrative interface behind an IP allowlist or VPN to reduce exposure to compromised administrator credentials
# Example Content Security Policy header for the Grav admin interface
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
