deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7g78-5g5g-mvfj
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab

Details:
## Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][template]` parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.

---

## Details

**Vulnerable Endpoint:** `POST /admin/pages/[page]`  
**Parameter:** `data[header][template]`

The application fails to properly sanitize user input in the `data[header][template]` field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.

---

## PoC

**Payload:**

`<script>alert('PoC-XXS73')</script>`

### Steps to Reproduce:

1. Log in to the _Grav_ Admin Panel and navigate to **Pages**.
    
2. Create a new page or edit an existing one.
    
3. In the **Advanced > Template** field (which maps to `data[header][template]`), insert the payload:
![image](https://github.com/user-attachments/assets/fc92aa09-e363-4422-b577-63aa27097886)

4. Save the page.
    
5. Return to the **Pages** section and click on the **three-dot menu** of the affected page: 
![image](https://github.com/user-attachments/assets/ea6a023b-f838-4700-b2a8-8dcfbca37f00)

6. The stored XSS payload is triggered, and the script is executed in the browser:
![image](https://github.com/user-attachments/assets/8cf1cca5-ce8f-4b09-a57c[PII_REDACTED]ac)
---

## Impact

Stored XSS vulnerabilities can have serious consequences, including:

- **Session hijacking:** Capturing admin session cookies or tokens
    
- **Malware delivery:** Executing scripts that load malicious resources
    
- **Credential theft:** Creating fake login prompts to steal usernames/passwords
    
- **Data exposure:** Reading sensitive metadata or page contents
    
- **Privilege escalation:** Performing actions as an authenticated user
    
- **Website defacement:** Altering visual or functional elements of the site
    
- **Reputation damage:** Undermining user trust in the application

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
GitHub Security Advisory: GHSA-65mj-f7p4-wggq
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Details:
## Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][content][items]` parameter.

---

## Details

**Vulnerable Endpoint:** `GET /admin/pages/[page]`  
**Parameter:** `data[header][content][items]`

The application fails to properly validate and sanitize user input in the `data[header][content][items]` parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.

---

## PoC

**Payload:**

`"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>`

1. Log in to the _Grav_ Admin Panel and navigate to **Pages**.
    
2. Create a new page or edit an existing one.
    
3. In the **Advanced > Blog Config > Items** field (which maps to `data[header][content][items]`), insert the payload above.

![image](https://github.com/user-attachments/assets/ae77d92a-2e09-4b67-b3ae-5e317b9d518f)

4. Save the page.
     
5. The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.

![image](https://github.com/user-attachments/assets/328b0714-750a-421d-ad5e-ea7f148dca8f)

---

## Impact

Reflected cross-site scripting (XSS) attacks can have serious consequences, including:

- **User actions:** Attackers can perform actions on behalf of the user
    
- **Data theft:** Sensitive information such as session cookies can be stolen
    
- **Account compromise:** Attackers may impersonate legitimate users
    
- **Malicious code execution:** Arbitrary JavaScript code can run in the user’s browser
    
- **Website defacement or misinformation:** Malicious output may be injected visually
    
- **User redirection:** Victims may be redirected to phishing or malicious websites

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
GitHub Security Advisory: GHSA-h756-wh59-hhjv
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Details:
### Summary
When a user with privilege of user creation creates a new user through the Admin UI and supplies a username containing path traversal sequences (for example ..\Nijat or ../Nijat), Grav writes the account YAML file to an unintended path outside user/accounts/. The written YAML can contain account fields such as email, fullname, twofa_secret, and hashed_password. In my tests,  I was able to cause the Admin UI to write the following content into arbitrary .yaml files (including files like email.yaml, system.yaml, or other site YAML files like admin.yaml) — demonstrating arbitrary YAML write / overwrite via the Admin UI.

Example observed content written by the Admin UI (test data):
username: ..\Nijat
state: enabled
email: [EMAIL@gmail.com](mailto:EMAIL@gmail.com)
fullname: 'Nijat Alizada'
language: en
content_editor: default
twofa_enabled: false
twofa_secret: RWVEIHC2AFVD6FCR6UHCO3DS4HWXKKDT
avatar: { }
hashed_[CREDENTIAL_REDACTED]
access:
site:
login: true


### Steps to Reproduce
1. Log in to the Grav Admin UI as an administrator.
2. Create a new user with the following values (example):
        a. Username: ..\POC-TOKEN-2025-09-29
        b. Fullname: POC-TOKEN-2025-09-29
        c. Email: poc+2025-09-29@example.test
        d. Password: (any password)
Observe that a YAML file containing the POC-TOKEN is written outside user/accounts/ (for example in the parent directory of user/accounts)


### Impact
1. Config corruption / service disruption: Overwriting system.yaml, email.yaml, or plugin config files with attacker-controlled YAML (even if limited to fields present in account YAML) could break functionality, disable services, or cause misconfiguration requiring recovery from backups.
2. Account takeover, any user with create user privilege can modify other user's email and password by just creating a new user with the name "..\accounts\USERNAME_OF_VICTIM"


### Proof of Concept
https://github.com/user-attachments/assets/cf503d74-f765-4031-8e22-71f6b3630847
GitHub Security Advisory: GHSA-m8vh-v6r6-w7p6
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-248: Uncaught Exception
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

Details:
**Endpoint**: `admin/config/system`  
**Submenu**: `Languages`  
**Parameter**: `Supported`  
**Application**: Grav v 1.7.48

---

## Summary

A Denial of Service (DoS) vulnerability was identified in the **"Languages"** submenu of the Grav **admin configuration panel** (`/admin/config/system`). Specifically, the `Supported` parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (`/`) or an XSS test string—it causes a fatal regular expression parsing error on the server.

This leads to application-wide failure due to the use of the `preg_match()` function with an **improperly constructed regular expression**, resulting in the following error:

`preg_match(): Unknown modifier 'o' File: /system/src/Grav/Common/Language/Language.php line 244`

Once triggered, the site becomes completely unavailable to all users.

---

## Details

- **Vulnerable Endpoint**: `POST /admin/config/system`
    
- **Submenu**: `Languages`
    
- **Parameter**: `Supported`  
    

The application dynamically constructs a regular expression using the contents of the `Supported` field without escaping the input using `preg_quote()` or proper validation. This allows attackers to inject invalid syntax into the regex engine, crashing the application during language resolution.

**Stack trace excerpt**:

`Whoops \ Exception \ ErrorException (E_WARNING) preg_match(): Unknown modifier 'o' /system/src/Grav/Common/Language/Language.php244`

---

## Proof of Concept (PoC)

### Payloads:

`/ `

### Steps to Reproduce:

1. Log into the Grav Admin Panel.
    
2. Navigate to: **Configuration** → **System** → **Languages**.
    
3. Locate the `Supported` field.
    
4. Insert one of the payloads above (e.g., a single slash `/`).
    
5. Click **Save**.

<img width="1897" height="639" alt="Pasted image[PII_REDACTED]3223" src="https://github.com/user-attachments/assets/d3a54a20-d30d-46c6-9015-722f80701cfb" />

1. Observe: All pages in the application begin throwing a fatal error and become inaccessible.

<img width="1802" height="998" alt="Pasted image[PII_REDACTED]5229" src="https://github.com/user-attachments/assets/b16750c2-507f-4c30-a9bb-d07fa92bb777" />

---

## Impact

- Application-wide Denial of Service (DoS)
    
- All login and admin views crash with the same error
    
- Potentially exploitable by:
    
    - Admin panel users
        
    - CSRF if misconfigured        
    

---

## References

- **CWE-1333**: Improper Regular Expression
    
- **CWE-20**: Improper Input Validation


## Discoverer

[Marcelo Queiroz](www.linkedin.com/in/marceloqueirozjr) 

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
GitHub Security Advisory: GHSA-4cwq-j7jv-qmwg
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Details:
## **Summary**

An **IDOR (Insecure Direct Object Reference)** vulnerability in the Grav CMS Admin Panel allows **low-privilege users to access sensitive information** from other accounts.
Although direct account takeover is not possible, **admin email addresses and other metadata can be exposed**, increasing the risk of phishing, credential stuffing, and social engineering.

---

## **Details**

* **Endpoint:** `/admin/accounts/users/{username}`
* **Tested Version:** Grav Admin 1.7.48
* **Affected Accounts:** Authenticated users with **0 privileges** (non-privileged accounts)

**Description:**
Requesting another user’s account details (e.g., `/admin/accounts/users/admin`) as a low-privilege user returns an HTTP **403 Forbidden** response.
However, sensitive information such as the **admin’s email address** is still present in the **response source**, specifically in the `<title>` tag.

**system/src/Grav/Common/Flex/Types/Users/UserCollection.php**
<img width="700" height="327" alt="Screenshot 2025-08-24 021027" src="https://github.com/user-attachments/assets/7e69ae49-d8fc-442f-b00c-9efaec706b2e" />

**system/blueprints/flex/user-accounts.yaml**
<img width="700" height="300" alt="Screenshot 2025-08-24 020521" src="https://github.com/user-attachments/assets/756631c8-d60b-4b84-a08a-2a9c2f81b41f" />


This is a classic **IDOR vulnerability**, where object references (usernames) are not properly protected from unauthorized enumeration.

---

## **PoC**

1. Log in as a **non-privileged user** (0-privilege account).
2. Access another user’s endpoint, for example:

   ```
   GET /admin/accounts/users/admin
   ```
3. Observe the HTTP **403 Forbidden** response.
4. Inspect the **page source**; sensitive data such as the **admin email** can be seen in the `<title>` tag.

**PoC Video:** 

[https://drive.google.com/file/d/1lY_qwqSkN5sPNmHvXGOk6R1mdIgVt71H/view](https://drive.google.com/file/d/1lY_qwqSkN5sPNmHvXGOk6R1mdIgVt71H/view)

---

## **Impact**

* **Type:** Information Disclosure via IDOR
* **Who is impacted:** Low-privilege authenticated users can enumerate other accounts and extract sensitive metadata (admin emails).
* **Risk:** Exposed information can be used for targeted phishing, credential stuffing, brute-force attacks, or social engineering campaigns.
* **Severity Justification:** Only a low-privilege account is required, and sensitive metadata is leaked. Arbitrary code execution is not possible, but the information exposure is **moderate risk**.

---

## **Disclosure & CVE Request**

* We request a **CVE ID** for this vulnerability once validated.
* Please credit the discovery to:

  * **Elvin Nuruyev**
  * **Kanan Farzalili**
GitHub Security Advisory: GHSA-j422-qmxp-hv94
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav vulnerable to Path Traversal allowing server files backup

Details:
### Summary
```
A path traversal vulnerability has been identified in Grav CMS, versions 1.7.49.5 , allowing authenticated attackers
 with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due
 to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling
 access to files outside the intended webroot directory. The impact of this vulnerability depends on the privileges of 
the user account running the application.
```

### PoC
```
To accurately demonstrate the maximum potential impact of this vulnerability, the testing environment was configured in a specific way:

- Elevated Privileges: The application was run locally with the highest possible system privileges, operating under the **`root`** user account.
    
- Objective: This configuration was chosen to unequivocally show that the path traversal vulnerability is not just a theoretical issue but can lead to a complete compromise of the underlying host when combined with poor operational practices. The ability to read any file on the system is the ultimate test of the flaw's severity.
    

Proof of Concept Goal: Under these conditions, the subsequent PoC will exploit the vulnerability to read the SSH private key
 of the `root` user (`/root/.ssh/id_rsa`). The successful exfiltration of this key represents a worst-case scenario, as it would provide 
an attacker with persistent, undetectable, and complete administrative access to the host server. This highlights the critical intersection
 of an application-layer vulnerability and a infrastructure-level misconfiguration.

```




```
1- LOGIN AS ADMIN AND  GO TO  : http://127.0.0.1/admin/tools/backups
2- Change 'Root Folder' to backup directory /../../../../../../../root/.ssh/ 

```
<img width="1902" height="492" alt="Screenshot 2025-09-11 161519" src="https://github.com/user-attachments/assets/23a60dc3-7758-4e24-b910-e66a1dd1f5e2" />



```
3- CLICK  : 'SAVE'
4- CLICK  : 'Backup Now'
```

<img width="1916" height="512" alt="Screenshot 2025-09-11 154151" src="https://github.com/user-attachments/assets/88a63ff2-777e-467e-857b-0644ef698499" />

```
5- Extract Backup :
```


<img width="704" height="101" alt="Screenshot 2025-09-11 160114" src="https://github.com/user-attachments/assets/b91ce4db-9843-4280-b8f0-32c73aa12d4d" />
<img width="567" height="101" alt="Screenshot 2025-09-11 160135" src="https://github.com/user-attachments/assets/155ce7d8-c2fc-4b54-b054-f7c7550bec82" />
GitHub Security Advisory: GHSA-rmw5-f87r-w988
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.8.0-beta.27
Patched in: 1.8.0-beta.27

Summary: Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`

Details:
## Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/accounts/groups/Grupo` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[readableName]` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

---

## Details

**Vulnerable Endpoint:** `POST /admin/accounts/groups/Grupo`  
**Parameter:** `data[readableName]`

The application fails to properly validate and sanitize user input in the `data[readableName]` parameter. This lack of input handling allows attackers to inject arbitrary script content that is stored in the application and executed in the browser of any user who views the affected group configuration.

---

## PoC

**Payload:**

`<ScRipT>alert('PoC-XSS')</ScRipT>`

1. Navigate to **Accounts > Groups** in the administrative panel.
    
2. Create a new group or edit an existing one.
    
3. In the **Display Name** field (`data[readableName]`), insert the payload above and save the changes.

![image](https://github.com/user-attachments/assets/e6db531e-9968-4fc5-8[PII_REDACTED]5096c)


The following HTTP request was generated during this action:
![image](https://github.com/user-attachments/assets/37e9a2c6-f7be-45b4-8aaf-13e64940561f)


4. Next, go to **Accounts > Users** and open any user profile.

![image](https://github.com/user-attachments/assets/a09215ab-17a2-4b17-9b58-cf3737d95ba2)


5. The malicious script is executed immediately in the browser when the page loads, confirming the existence of a **Stored XSS** vulnerability.

![image](https://github.com/user-attachments/assets/8411ca04-4d84-4f88-9c6a-7dd88e65a6e0)


---

## Impact

Stored XSS vulnerabilities can result in serious consequences, including:

- **Session hijacking:** Attackers can steal authentication cookies or tokens
    
- **Malware delivery:** Inserting scripts that download malicious content
    
- **Credential theft:** Capturing usernames and passwords through injected forms
    
- **Sensitive data exposure:** Accessing data stored in the browser or the application
    
- **Browser takeover:** Executing arbitrary commands in the user’s session
    
- **Phishing attacks:** Redirecting users to fake login or malicious sites
    
- **Website defacement:** Altering page content shown to users
    
- **Reputational damage:** Undermining trust in the platform or organization

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)
GitHub Security Advisory: GHSA-mpjj-4688-3fxg
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.11.0-beta.1
Patched in: 1.11.0-beta.1

Summary: Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Details:
## Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][metadata]`, `data[header][taxonomy][category]`, and `data[header][taxonomy][tag]` parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface.

---

## Details

**Vulnerable Endpoint:** `POST /admin/pages/[page]`  
**Parameters:**

- `data[header][metadata]`
    
- `data[header][taxonomy][category]`
    
- `data[header][taxonomy][tag]`
    

The application fails to properly sanitize user input when saving page metadata or taxonomy fields via the Admin Panel. As a result, an attacker with access to the admin interface can inject a malicious script using these parameters, and the script will be stored in the page's YAML frontmatter. When the page or metadata is rendered (especially in the Admin Panel), the payload is executed in the browser of any user with access.

---

## PoC

**Payload:**

`<script>alert('PoC-XXS51')</script>`

### Steps to Reproduce:

1. Log into the _Grav_ Admin Panel and navigate to **Pages**.
    
2. Create or edit a page.
    
3. Inject the payload above into any of the following fields in the Options tab:
    
    - **Metadata** key name
        
    - **Category** under Taxonomy
        
    - **Tag** under Taxonomy
![image](https://github.com/user-attachments/assets/b66f3d4d-8f9d-40a9-83a8-5a365814c00b)

![image](https://github.com/user-attachments/assets/a1164198-2e25-4746-acb5-71f4874aebbe)

4. Save the page.
![image](https://github.com/user-attachments/assets/6c9c0ba4-bce3-4a72-a10f-39b0b886a10c)

When the page is loaded again in the Admin Panel or potentially on the frontend (depending on how the metadata is used), the script is executed, confirming the **Stored XSS** vulnerability.

---

## Impact

Stored XSS vulnerabilities can result in serious consequences, including:

- **Session hijacking:** Attackers can steal authentication cookies or tokens
    
- **Malware delivery:** Injected scripts can download malicious software
    
- **Credential theft:** Fake input fields can capture usernames and passwords
    
- **Sensitive data exposure:** Access to internal metadata and browser data
    
- **Administrative access compromise:** Especially dangerous in admin-facing interfaces
    
- **Phishing attacks:** Users can be redirected to external malicious sites
    
- **Reputation damage:** Executing arbitrary scripts in trusted systems undermines credibility

by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)