CVE-2026-64628 Overview
CVE-2026-64628 is a stored cross-site scripting (XSS) vulnerability in the Grav flat-file content management system. The flaw resides in the shortcode-core attribute handlers, where the XSS detection scan only matches payloads that contain literal angle brackets. Attackers can bypass the validation logic by injecting JavaScript through shortcode attributes that omit angle brackets. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
An authenticated attacker with admin.pages permission can inject JavaScript that executes in any viewer's browser, including administrators, leading to admin nonce theft and session hijacking.
Affected Products
- Grav CMS (getgrav/grav)
- Grav shortcode-core plugin attribute handlers
- Grav administrator sessions of users with admin.pages privileges
Discovery Timeline
- 2026-07-21 - CVE-2026-64628 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-64628
Vulnerability Analysis
Grav's shortcode processor accepts user-supplied attributes and later renders them into HTML output. The framework includes an XSS detection routine intended to reject unsafe content before storage. That routine only inspects payloads for literal < and > characters, treating angle brackets as the sole indicator of script injection.
Because shortcode attribute values are rendered into HTML attribute contexts, JavaScript can execute without angle brackets. Attackers can supply payloads that use event handlers, javascript: URIs, or attribute breakout sequences that never contain < or >. The detection scan reports the content as safe, Grav persists the malicious shortcode, and each subsequent page view executes the payload in the visitor's browser.
Root Cause
The root cause is incomplete input validation. The sanitization function was designed with a threat model that assumed script injection requires angle brackets. It does not enforce context-aware output encoding for attribute values, nor does it filter dangerous keywords such as onerror, onload, or javascript: in shortcode parameters. This produces a stored XSS primitive that is durable across page loads.
Attack Vector
Exploitation requires an authenticated account with the admin.pages permission. The attacker edits a page and inserts a shortcode with a crafted attribute whose value contains a JavaScript event handler or URI scheme. Grav saves the content, and when any authenticated user (including an administrator) views the affected page, the injected code runs with the viewer's privileges. Because Grav administrators authorize sensitive actions with nonces, the payload can exfiltrate the admin nonce and perform arbitrary administrative operations through cross-site request forgery, effectively hijacking the session.
Refer to the GitHub Security Advisory GHSA-q5fw-vpqc-fgph and the VulnCheck Advisory on XSS for the technical write-up.
Detection Methods for CVE-2026-64628
Indicators of Compromise
- Shortcode entries in user/pages/ markdown files containing attribute values with on*= event handlers or javascript: URIs.
- Unexpected outbound requests originating from administrator browser sessions immediately after viewing content pages.
- Modifications to page content by low-privileged editor accounts that include shortcodes with unusual attribute strings.
Detection Strategies
- Scan stored page content for shortcode attribute values matching regex patterns such as on\w+\s*= or javascript: regardless of angle-bracket presence.
- Audit Grav admin logs for admin.pages editors performing rapid successive edits followed by administrator page visits.
- Correlate administrator authentication tokens with anomalous API calls to /admin endpoints that occur without corresponding user-initiated navigation.
Monitoring Recommendations
- Enable web server access logging and forward Grav admin activity to a centralized logging platform for behavioral analysis.
- Deploy a Content Security Policy (CSP) in report-only mode to identify inline script executions triggered by shortcode rendering.
- Monitor Git or filesystem change history on the user/pages/ directory for unauthorized shortcode insertions.
How to Mitigate CVE-2026-64628
Immediate Actions Required
- Upgrade Grav to the patched release referenced in GHSA-q5fw-vpqc-fgph as soon as it is available in your environment.
- Audit all accounts holding the admin.pages permission and remove access from users who do not require content editing.
- Review recently modified pages for shortcodes containing suspicious attribute values and revert malicious content.
Patch Information
The Grav maintainers addressed the flaw by hardening the shortcode-core XSS detection scan so that attribute values are validated for dangerous constructs beyond literal angle brackets. Apply the fixed version published in the vendor advisory. Consult the GitHub Security Advisory for the specific patched version and commit references.
Workarounds
- Restrict the admin.pages permission to trusted administrators until the patch is applied.
- Disable the shortcode-core plugin on affected sites if shortcodes are not required for content authoring.
- Enforce a strict Content Security Policy that blocks inline event handlers and javascript: URIs to reduce the impact of stored payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
