CVE-2026-75107 Overview
CVE-2026-75107 is a stored cross-site scripting (XSS) vulnerability in the Grav Form Plugin before version 9.1.19. The plugin fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels within form templates. Authenticated users with form authoring privileges can inject arbitrary HTML and JavaScript into these properties. The injected payload executes in the browser of every visitor who renders the affected form. The flaw is tracked under [CWE-79] and is documented in the GitHub Security Advisory GHSA-5jrr-wfgh-mhg9.
Critical Impact
Attackers with form authoring rights can execute arbitrary JavaScript in the context of every visitor rendering a compromised Grav form, enabling session theft, credential harvesting, and administrator account takeover.
Affected Products
- Grav CMS Form Plugin versions prior to 9.1.19
- Grav sites permitting form authoring by non-administrative editors
- Any Grav deployment rendering user-authored form field definitions
Discovery Timeline
- 2026-08-18 - CVE-2026-75107 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75107
Vulnerability Analysis
The Grav Form Plugin renders form field definitions through Twig templates that emit several properties without HTML escaping. Field attributes such as prepend, append, spacer text, section text, and select option labels flow into the output using the Twig |raw filter or are placed into unquoted HTML attributes. Because these values originate from form definition files editable through the Grav admin interface, any user granted form authoring privileges controls the raw markup written into rendered pages.
When a visitor loads the form, the browser parses the injected markup and executes attacker-controlled JavaScript in the site origin. The payload persists across sessions because it lives in the form definition on disk, making this a stored XSS rather than a reflected one. Exploitation is not fully unauthenticated: an attacker requires an account with permission to create or edit forms, which reduces the pool of viable actors but does not eliminate risk in multi-author sites.
Root Cause
The root cause is missing output encoding in the plugin's Twig templates. Trusted-by-default rendering with |raw and unquoted attribute contexts bypasses Twig's automatic HTML escaping, allowing raw markup from field configuration to reach the DOM unchanged.
Attack Vector
An authenticated attacker with form authoring privileges edits a form definition and inserts an HTML or JavaScript payload into a vulnerable property such as an option label or spacer text. Every subsequent visitor to the form triggers execution. Successful exploitation requires user interaction to load the affected page. See the VulnCheck Advisory on Grav Plugin for additional technical context.
Detection Methods for CVE-2026-75107
Indicators of Compromise
- Form definition YAML files containing <script>, onerror=, onload=, or javascript: strings inside prepend, append, text, or option label fields
- Unexpected outbound requests from client browsers to attacker-controlled domains after loading Grav form pages
- New or modified form files in user/pages/**/form.md or user/data/forms/ authored by non-administrative accounts
Detection Strategies
- Scan the Grav content tree for form field properties containing HTML tags or JavaScript event handlers
- Review web server access logs for form page requests followed by anomalous cross-origin requests referencing document cookies
- Audit Grav user accounts and their assigned form authoring permissions to identify unexpected privilege grants
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script violations on pages that render forms
- Alert on filesystem writes to Grav form definition files by non-administrator accounts
- Monitor admin plugin authentication events and correlate with subsequent form definition changes
How to Mitigate CVE-2026-75107
Immediate Actions Required
- Upgrade the Grav Form Plugin to version 9.1.19 or later on all Grav installations
- Audit all existing form definitions for injected HTML or JavaScript in prepend, append, spacer, section, and option label fields
- Revoke form authoring privileges from accounts that do not require them and rotate admin credentials if compromise is suspected
Patch Information
The upstream fix is delivered in Grav Form Plugin 9.1.19, which introduces proper escaping of the affected field properties. Refer to the GitHub Security Advisory GHSA-5jrr-wfgh-mhg9 for the authoritative fix reference and upgrade guidance.
Workarounds
- Restrict form authoring permissions to trusted administrators until the plugin is upgraded
- Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources on pages that render forms
- Manually sanitize existing form YAML files by removing HTML tags from prepend, append, text, and option label values
# Upgrade the Grav Form plugin via the Grav CLI
bin/gpm update form
# Verify the installed version is 9.1.19 or later
bin/gpm info form | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
