CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS

Grav CMS is a flat-file content management system that processes content via Markdown and HTML rendering. To ensure safety, Grav employs a centralized security class containing a detectXss() method designed to intercept malicious scripts, event handlers, and unauthorized XML namespaces.

The attack surface of Grav CMS includes markdown-enabled input fields, pages, and metadata accessible to authenticated administrative users and editors. In certain configurations, plugins may expose this filter to unauthenticated inputs, widening the risk vector.

The core of the vulnerability is a parser-differential bug classified under CWE-79. The input validation filter relies on regular expressions that fail to accurately predict the state-machine logic used by modern web browsers when encountering malformed HTML.

The root cause lies in how Security::detectXss() tracks quote pairs. The filter uses regex patterns to identify inline event handlers (such as onerror=) while attempting to ignore harmless occurrences of these sequences within valid quoted attribute strings.

In HTML5, a quote character only starts a quoted attribute state if it immediately follows an equals sign (e.g., attr="value"). An unanchored quote inside an unquoted attribute string (such as the double quote in src=x") is parsed by browsers as a literal character rather than a string delimiter. The browser remains in the unquoted attribute state, and subsequent characters like space and onerror= are parsed as new, independent attributes.

In contrast, the PHP regex parser used in detectXss() treats any quote character as the start of an enclosed string literal. Upon encountering the unpaired quote inside src=x", the engine searches for a matching closing quote, consuming the rest of the element, including the real malicious event-handler attribute. Because the handler is matched inside what the regex assumes is a benign string, validation succeeds.

The vulnerable regular expression configuration in system/src/Grav/Common/Security.php used a generic matching sequence for quotes: (?:"[^"]"|'[^']'). This pattern matched quotes globally without checking if they were actually part of an attribute assignment.

Below is the code snippet comparing the vulnerable and patched regex patterns:

// Vulnerable configuration
'on_events' => '#<(?:"[^"]*"|\'[^']*\'|[^>"\'])*?(?:[\s\x00-\x20\"\u0027\/]|"[^"]*"|\'[^']*\')on\s*[a-z]+\s*=#iu',
 
// Patched configuration in 2.0.15
'on_events' => '#<(?:=\s*"[^"]*"|=\s*\'[^']*\'|[^>])*?(?:[\s\x00-\x20\"\u0027\/]|=\s*"[^"]*"|=\s*\'[^']*\')on\s*[a-z]+\s*=#iu',

The updated regex binds the quote character to an assignment pattern (=\s*) before allowing the parser to consume the content as a string literal. If the quote is not preceded by an equals sign, the parser falls back to matching it as an ordinary tag-body character, forcing the scanner to process the subsequent onerror event handler correctly.

An authenticated editor with permissions to modify site markdown files can insert the malformed payload through the administration panel. Once saved, the raw string is written directly to the flat-file database.

The parser divergence can be visualized in the following diagram:

The payload <img src=x" onerror="alert(document.domain)"> cleanly bypasses the regular expression filter while remaining completely syntactically functional in Chromium-based and Firefox browsers, resulting in arbitrary JavaScript execution when the page is viewed.

The impact of stored cross-site scripting in a CMS environment like Grav is significant. An attacker can hijack the sessions of administrative users who visit the compromised pages, leading to complete control over the application.

Session hijacking allows attackers to execute administrative actions, such as adding backdoor accounts, installing malicious plugins, or reading confidential environment configurations.

Given the flat-file nature of Grav, access to the administration panel translates directly to remote code execution (RCE) on the underlying server. Since administrators can write templates or execute PHP files through standard features, XSS represents a gateway to complete host compromise.

Security administrators must update Grav installations to version 2.0.15 immediately. If an automatic update via the administration console is not possible, the command-line package manager can be used.

For legacy installations where upgrading the entire CMS is infeasible, the patches to system/src/Grav/Common/Security.php should be applied manually to anchor all quote validation steps to the = operator.

Temporary protections can be configured on web application firewalls (WAF) to intercept requests containing unquoted attributes containing internal quotes followed by script handles. An example detection signature has been verified for application-level proxies.