Grav is Vulnerable to Stored XSS via Tag Injection
Date: 2026-05
Affected: composer/getgrav/grav
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-42607
CVE-2026-42608
CVE-2026-42609
CVE-2026-42610
CVE-2026-42611
CVE-2026-42612
CVE-2026-42841
CVE-2026-42842
CWE: CWE-22
CWE-269
CWE-285
CWE-611
CWE-639
CWE-79
CWE-837
CWE-863
CWE-94
CVSS: 8.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:H)

### Summary A low-privileged (with the ability to create a page) user can cause XSS with the injection of `svg` element. The XSS can further be escalated to dump the entire system information available under `/admin/config/info` whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). ### Details Affected endpoint: `admin/pages/<page>` Affected code: `system/src/Grav/Common/Security.php` ```php public static function detectXss($string, array $options = null): ?string { // Skip any null or non string values if (null === $string || !is_string($string) || empty($string)) { return null; } if (null === $options) { $options = static::getXssDefaults(); } $enabled_rules = (array)($options['enabled_rules'] ?? null); $dangerous_tags = (array)($options['dangerous_tags'] ?? null); if (!$dangerous_tags) { $enabled_rules['dangerous_tags'] = false; } $invalid_protocols = (array)($options['invalid_protocols'] ?? null); if (!$invalid_protocols) { $enabled_rules['invalid_protocols'] = false; } $enabled_rules = array_filter($enabled_rules, static function ($val) { return !empty($val); }); if (!$enabled_rules) { return null; } // Keep a copy of the original string before cleaning up $orig = $string; /


Mitigations:

Architectural layers (MAESTRO):