Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
Date: 2025-12
Affected: composer/getgrav/grav
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-66307
CVE-2025-66308
CVE-2025-66310
CVE-2025-66311
CWE: CWE-204
CWE-79
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)

## Summary A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][template]` parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. --- ## Details **Vulnerable Endpoint:** `POST /admin/pages/[page]` **Parameter:** `data[header][template]` The application fails to properly sanitize user input in the `data[header][template]` field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface. --- ## PoC **Payload:** `<script>alert('PoC-XXS73')</script>` ### Steps to Reproduce: 1. Log in to the _Grav_ Admin Panel and navigate to **Pages**. 2. Create a new page or edit an existing one. 3. In the **Advanced > Template** field (which maps to `data[header][template]`), insert the payload: ![image](https://github.com/user-attachments/assets/fc92aa09-e363-4422-b577-63aa27097886) 4. Save the page. 5. Return to the **Pages** section and click on the **three-dot menu** of the affected page: ![image](https://github.com/user-attachments/assets/ea6a023b-f838-4700-b2a8-8dcfbca37f00) 6. The stored XSS payload is triggered,


Mitigations:

Architectural layers (MAESTRO):