CVE-2026-75828: Grav CMS Stored XSS Vulnerability

CVE-2026-75828 Overview

CVE-2026-75828 is a stored cross-site scripting vulnerability in Grav flat-file content management system versions before 2.0.15. The flaw exists in the detectXss() function, which fails to properly parse unquoted HTML attribute values containing unpaired quotes. Authenticated editors can craft payloads with event handlers such as onerror= that bypass the sanitizer and persist in stored page content. When visitors render the affected pages, the injected JavaScript executes in their browser context. The vulnerability maps to CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers with editor privileges can persistently inject JavaScript that executes against every visitor, enabling session theft, administrative account takeover, and full site compromise.

Affected Products

Grav CMS versions prior to 2.0.15
Grav installations exposing the admin editor to low-privileged editor accounts
Grav sites relying on the built-in detectXss() sanitization routine

Discovery Timeline

2026-08-18 - CVE-2026-75828 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75828

Vulnerability Analysis

Grav's detectXss() function scans user-submitted content for dangerous patterns, including HTML event handler attributes such as onerror, onload, and onclick. The detection logic assumes that attribute values are either quoted with matching delimiters or that quote characters appear in balanced pairs. Attackers can violate this assumption by supplying HTML with unpaired quotes inside unquoted attribute values. The parser interprets the malformed markup differently than the sanitizer does, and event-handler attributes slip through validation. Grav then stores the payload verbatim and serves it to visitors, where the browser reconstructs the element and fires the injected handler.

Root Cause

The root cause is a parser differential between detectXss() and the browser's HTML tokenizer. The sanitizer uses regular-expression-style matching that treats quote characters as boundary markers, while browsers tolerate unpaired quotes and continue parsing attributes. This mismatch allows event-handler attributes to appear invisible to Grav's filter while still being active in the rendered DOM.

Attack Vector

Exploitation requires an authenticated account with content-editing privileges. The attacker submits a page or content field containing an HTML tag with an unpaired quote followed by an event-handler attribute, for example an <img> element whose src value contains an unbalanced quote and an appended onerror= payload. The payload passes detectXss() validation and is saved to the flat-file store. Any user, including anonymous site visitors and administrators, executes the injected script when they load the page. The stored nature of the flaw amplifies impact because a single successful injection persists across sessions and can be used to escalate to admin-level accounts.

No verified public exploit code is available at the time of publication. Technical detail is provided in the GitHub Security Advisory and the VulnCheck Advisory on Grav XSS.

Detection Methods for CVE-2026-75828

Indicators of Compromise

Stored Grav content files containing HTML attribute strings with unpaired single or double quotes adjacent to on*= event handlers.
Unexpected <script>, <img onerror=...>, or <svg onload=...> fragments in Markdown or page frontmatter under user/pages/.
Admin audit logs showing content edits from editor accounts followed by anomalous outbound requests from visitor sessions.

Detection Strategies

Grep the user/pages/ tree and content backups for regular expressions matching on\w+\s*= inside stored Markdown and HTML.
Deploy a Content Security Policy in report-only mode and monitor violation reports for inline script executions on public pages.
Review web server access logs for spikes in requests to admin endpoints from previously benign editor accounts.

Monitoring Recommendations

Forward Grav access, admin, and PHP error logs to a centralized analytics platform and alert on repeated edits containing HTML tags with event-handler attributes.
Alert on browser-side telemetry showing script execution from Grav-hosted origins that references unexpected external domains.
Monitor authentication events for editor-role accounts, especially credential resets or privilege changes that follow suspicious content edits.

How to Mitigate CVE-2026-75828

Immediate Actions Required

Upgrade Grav to version 2.0.15 or later on all production and staging instances.
Audit stored page content for event-handler attributes and remove any injected payloads before restoring public access.
Rotate admin session cookies and review editor account membership to remove unused or untrusted accounts.

Patch Information

The Grav maintainers addressed the flaw in version 2.0.15 by hardening detectXss() to correctly handle unquoted and unbalanced attribute values. Administrators should apply the update per the GitHub Security Advisory. After patching, clear Grav's cache and recompile page assets so that any previously stored payloads are re-evaluated against the updated sanitizer.

Workarounds

Restrict the editor role to fully trusted users until the patched release is deployed.
Enforce a strict Content Security Policy that disallows inline event handlers and inline scripts on all public pages.
Place Grav behind a web application firewall with rules that block HTML attribute payloads containing on\w+= combined with unbalanced quote characters.

bash

# Example CSP header to block inline event-handler execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;