CVE-2026-75834 Overview
CVE-2026-75834 is a stored cross-site scripting (XSS) vulnerability in Grav CMS versions before 2.0.14. The flaw resides in the Security::detectXss() function within system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u (UTF-8) modifier, which causes preg_match() to return false when input contains any invalid UTF-8 byte. This silent failure bypasses the save-time XSS safety gate enforced by Validation::checkSafety(). An authenticated attacker with page-edit permissions can store malicious JavaScript that executes in the browser of any visitor viewing the affected page. The issue is tracked under [CWE-79].
Critical Impact
Authenticated users without the security.xss_whitelist privilege can inject persistent JavaScript into Grav pages, executing arbitrary script in the browser context of any subsequent viewer.
Affected Products
- Grav CMS versions prior to 2.0.14
- Installations relying on Security::detectXss() for save-time content filtering
- Multi-author Grav deployments granting page-edit permissions to non-administrators
Discovery Timeline
- 2026-08-18 - CVE-2026-75834 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75834
Vulnerability Analysis
Grav applies a set of regular expression patterns in Security::detectXss() to identify script injection attempts before content is persisted. Every pattern is compiled with the PCRE /u modifier, instructing PCRE to interpret the subject string as UTF-8. When the subject contains any byte sequence that is not valid UTF-8, PCRE aborts pattern matching and preg_match() returns boolean false instead of 0 or 1.
The caller, Validation::checkSafety(), treats the falsy return as "no XSS detected" and permits the save operation. As a result, the safety gate silently fails open for the entire content blob whenever a single invalid UTF-8 byte is present anywhere in the payload.
An authenticated attacker with page-edit rights but without security.xss_whitelist can embed a stray byte such as 0xC0 alongside a <script> tag or event-handler attribute. The malicious markup is stored intact and rendered to every visitor of the affected page.
Root Cause
The root cause is missing error handling around preg_match() calls combined with the use of the /u modifier. PCRE's UTF-8 validation aborts the match on malformed input, but the code does not check preg_last_error() and does not distinguish between "pattern did not match" and "pattern could not run." This CWE-79 issue is a validator failure rather than an output-encoding failure.
Attack Vector
Exploitation requires an authenticated session with page-edit permissions on the target Grav instance. The attacker crafts page content that contains standard XSS payloads with at least one invalid UTF-8 byte injected into the surrounding text. On save, the safety check returns false for every pattern and the content is written to storage unchanged. Any visitor who later loads the page executes the attacker's JavaScript in their browser session under the origin of the Grav site, enabling session theft, administrative action forgery, or further pivoting. User interaction is required in the form of visiting the poisoned page.
See the GitHub Security Advisory GHSA-q2j8-x8hf-63ch and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-75834
Indicators of Compromise
- Grav page files (.md or frontmatter YAML) containing non-UTF-8 byte sequences adjacent to HTML tags, <script> blocks, or on* event-handler attributes.
- Unexpected modifications to page content by editor accounts that lack the security.xss_whitelist privilege.
- Browser console errors or Content Security Policy violations reported by visitors on specific Grav pages.
Detection Strategies
- Scan the Grav user/pages directory for files that fail UTF-8 validation, for example with iconv -f UTF-8 -t UTF-8 <file>.
- Review Grav admin audit logs for save events performed by accounts without XSS whitelist rights and cross-reference against pages containing script-like markup.
- Deploy web application firewall rules that flag POST bodies to Grav admin endpoints containing invalid UTF-8 combined with <script>, javascript:, or on event-handler tokens.
Monitoring Recommendations
- Alert on outbound requests from browsers loading Grav pages to unexpected domains, which may indicate exfiltration via injected JavaScript.
- Monitor administrative account creation, permission changes, and API key issuance in Grav following any page save by a lower-privileged editor.
- Instrument Content Security Policy reporting endpoints to capture inline-script violations sourced from public Grav pages.
How to Mitigate CVE-2026-75834
Immediate Actions Required
- Upgrade Grav to version 2.0.14 or later on every affected instance.
- Audit all editor and contributor accounts and remove page-edit permissions from users who do not require them.
- Review recently modified pages for embedded scripts, event handlers, or invalid UTF-8 sequences and revert suspicious changes.
Patch Information
The vendor addressed the issue in Grav 2.0.14. Patch details are published in the GitHub Security Advisory GHSA-q2j8-x8hf-63ch. Administrators should apply the upgrade before restoring normal editor workflows.
Workarounds
- Restrict page-edit permissions to trusted administrators until the patch is applied.
- Place Grav admin endpoints behind a WAF rule that rejects requests containing invalid UTF-8 byte sequences.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted event handlers on rendered Grav pages.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
