CVE-2026-85600 Overview
CVE-2026-85600 is a stored cross-site scripting (XSS) vulnerability in the Grav Admin plugin (getgrav/grav-plugin-admin2) affecting versions up to and including 2.0.19. The flaw resides in the tHtml() function within src/lib/stores/i18n.svelte.ts, which interpolates untrusted values such as usernames into translation templates and then parses the output as markdown. An attacker who registers an account with an HTML payload in the username can trigger script execution in an administrator's authenticated browser session when the admin views a UI surface that renders the username. The issue is fixed in version 2.0.21.
Critical Impact
Attackers with the ability to register a username can hijack authenticated administrator sessions in the Grav Admin panel, enabling site takeover through the administrator's privileges.
Affected Products
- Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19
- Grav CMS installations exposing the Admin plugin to untrusted registrants
- Fixed in Grav Admin plugin version 2.0.21
Discovery Timeline
- 2026-09-04 - CVE-2026-85600 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD
Technical Details for CVE-2026-85600
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79]. The tHtml() function accepts translation keys and parameter substitutions, injects them into a template string, and passes the result to a markdown parser that emits HTML. Because parameters are inserted before parsing, HTML metacharacters supplied through user-controlled fields survive into the final DOM output. Grav's username validator, DataUser::isValidUsername, rejects characters considered dangerous for the filesystem but permits <, >, ", and '. This gap between filesystem-safe and HTML-safe validation is the core of the issue.
Exploitation requires an administrator to view a screen that renders the malicious username through tHtml(). Documented sinks include the two-factor force-disable confirmation prompt and the "page is locked" editor notice. Once the payload executes, it inherits the administrator's origin and session, enabling arbitrary Admin API calls.
Root Cause
The root cause is unsafe template composition. Untrusted input is concatenated into a string that is subsequently interpreted as markdown, which itself permits raw HTML. Neither the translation layer nor the markdown renderer escapes parameters, and the registration validator does not block HTML metacharacters.
Attack Vector
An unauthenticated or low-privileged attacker registers a Grav account whose username contains an HTML or script payload. The payload persists in Grav's user store. When an administrator later interacts with a workflow that renders that username through tHtml(), the browser parses the payload and executes it in the admin session. Refer to the GitHub Security Advisory GHSA-96xm-c5hr-59rx and the VulnCheck Advisory: Grav Admin XSS for the confirmed exploitation surfaces.
Detection Methods for CVE-2026-85600
Indicators of Compromise
- User account records containing <, >, ", ', or script/onerror substrings in the username field within Grav's user://accounts store.
- Unexpected Admin API requests originating from administrator sessions shortly after viewing user lists, editor lock notices, or 2FA management pages.
- New administrator accounts or modified user roles created without a corresponding legitimate admin workflow.
Detection Strategies
- Audit the Grav accounts directory for usernames that fail an HTML-metacharacter safelist, not just the filesystem-character safelist enforced by DataUser::isValidUsername.
- Inspect web server access logs for POST requests to registration endpoints where the username parameter contains encoded HTML tags or event handler attributes.
- Correlate administrator page views of 2FA management or locked-page editor notices with subsequent privileged API activity from the same session.
Monitoring Recommendations
- Enable and centralize Grav Admin access and audit logs, forwarding them to a SIEM for retention and query.
- Monitor Content Security Policy (CSP) violation reports from the Admin panel for inline script executions blocked by policy.
- Alert on creation of new users whose serialized YAML account files contain HTML tag characters.
How to Mitigate CVE-2026-85600
Immediate Actions Required
- Upgrade the Grav Admin plugin to version 2.0.21 or later on every affected instance.
- Enumerate existing user accounts and remove or rename any username containing HTML metacharacters.
- Rotate administrator credentials and invalidate active admin sessions if malicious usernames are found.
Patch Information
The maintainers addressed the issue in getgrav/grav-plugin-admin2 version 2.0.21. The fix hardens tHtml() parameter handling and tightens username validation. Refer to the GitHub Security Advisory GHSA-96xm-c5hr-59rx for the upstream commit references and full patch notes.
Workarounds
- Disable public user self-registration in the Grav Admin configuration until the plugin is upgraded.
- Restrict access to the Grav Admin panel to trusted IP ranges through a reverse proxy or web application firewall (WAF).
- Deploy a strict Content Security Policy on the Admin panel that forbids inline scripts and unknown script sources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
