CVE-2026-61453: Grav CMS XSS Vulnerability

CVE-2026-61453 Overview

CVE-2026-61453 is a stored cross-site scripting (XSS) vulnerability in Grav CMS version 2.0.0, fixed in 2.0.1. The flaw exists in the Security::detectXss() blueprint validator, which inspects raw page content before Twig template processing occurs. When twig_content.process_enabled is set to true, an authenticated attacker with page-write API permission can bypass the validator using Twig's string concatenation operator (~). The validator sees only benign Twig expressions, but the rendered output contains active JavaScript payloads executed in visitor browsers. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers with page-write permissions can inject arbitrary JavaScript that executes in the browser of every visitor viewing the compromised page, enabling session hijacking and credential theft.

Affected Products

Grav CMS v2.0.0
Installations with twig_content.process_enabled: true
Deployments exposing the page-write API to untrusted users

Discovery Timeline

2026-07-15 - CVE-2026-61453 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61453

Vulnerability Analysis

Grav's XSS defense relies on Security::detectXss(), a static content validator that scans page content for dangerous tokens such as event handler names, dangerous tags, and script protocols. The validator runs at page save time, before the Twig templating engine processes any dynamic expressions. This ordering creates a temporal gap between validation and rendering that attackers can exploit.

When Twig content processing is enabled globally, page content is treated as a Twig template. Attackers use the string concatenation operator (~) to split dangerous tokens across multiple string literals. The validator inspects only literal strings and sees no matches for its dangerous-pattern deny list. After Twig renders the template, the concatenated strings produce fully formed malicious HTML.

Root Cause

The root cause is a validation-versus-rendering order-of-operations flaw. The Security::detectXss() function performs pattern matching on pre-render content, while output is emitted through the {{ page.content|raw }} filter that bypasses HTML escaping. Because the validator has no visibility into post-render output, any Twig expression that resolves to a dangerous string at render time evades detection.

Attack Vector

An attacker requires network access to the Grav administration API and an account with page-write permission. The attacker submits page content containing Twig expressions such as {% set x = "on" ~ "error" %} followed by markup that references the concatenated variable. When any visitor loads the page, the rendered HTML contains an active handler such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in the visitor's browser context. Impact includes session cookie theft, administrator account takeover through CSRF chaining, and defacement.

Detection Methods for CVE-2026-61453

Indicators of Compromise

Page content in the Grav filesystem or database containing Twig ~ concatenation combined with tokens such as "on", "error", "script", or "javascript"
Unexpected {% set %} blocks in user-authored pages that construct HTML attribute names or protocol strings
Outbound requests from visitor browsers to attacker-controlled domains following page views
New or modified pages authored by low-privilege accounts that contain raw HTML tags

Detection Strategies

Scan Grav page content files for regex patterns matching Twig concatenation adjacent to string fragments of known event handlers
Enable web server access logging and alert on responses containing rendered event handler attributes originating from user-editable pages
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script and handler violations on production pages

Monitoring Recommendations

Audit the Grav page-write API access log for accounts creating or modifying pages containing Twig expressions
Monitor changes to the twig_content.process_enabled configuration flag and alert on transitions to true
Review browser telemetry from site visitors for unexpected JavaScript execution or credential submission events

How to Mitigate CVE-2026-61453

Immediate Actions Required

Upgrade Grav to version 2.0.1 or later, which corrects the validator to run after Twig rendering
Set twig_content.process_enabled: false in system.yaml if Twig-in-content is not required by the site
Review all accounts with page-write API permission and revoke access for untrusted users
Audit existing page content for Twig concatenation patterns and remove any suspicious constructs

Patch Information

The vendor released a fix in Grav 2.0.1. Details are available in the GitHub Security Advisory GHSA-2c4f-86xc-cr74 and the VulnCheck Advisory on XSS via Twig String Concatenation.

Workarounds

Disable Twig content processing globally by setting twig_content.process_enabled: false until patching is complete
Restrict page-write API permissions to trusted administrators only
Deploy a strict Content Security Policy that blocks inline event handlers and untrusted script sources
Place a web application firewall rule in front of the Grav admin API to block requests containing Twig concatenation patterns in page body fields

bash

# Configuration example: disable Twig-in-content processing in system.yaml
twig_content:
  process_enabled: false