CVE-2026-72832
published 2026-08-14CVE-2026-72832: Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.31%
23.1th percentile
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | >= 1.5.2 < 2.0.13 | 2.0.13 |
| getgrav | grav | 1.5.2 – 2.0.12 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Grav: Stored XSS via quoted-attribute bypass in detectXss
ghsa·2026-09-17
CVE-2026-72832 [MEDIUM] CWE-79 Grav: Stored XSS via quoted-attribute bypass in detectXss
Grav: Stored XSS via quoted-attribute bypass in detectXss
### Summary
A page editor without `admin.super` can place an event handler after a `>` inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.
### Details
`Security::detectXss()` (`system/src/Grav/Common/Security.php:253`) anchors the `on_events` scan at `]*?`, which cannot cross the first literal `>`. When that character is inside a quoted value, the browser keeps the tag open and parses the later `onerror` attribute, so the detector and browser disagree. `AdminController::savePage()` relies on this detector when saving content from page editors outside the `admin.super` whitelist.
### PoC
I reproduced this with `getgrav/grav` 2.0.11 (`ad9709f86
GHSA
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php).
ghsa_unreviewed·2026-08-14
CVE-2026-72832 [MEDIUM] CWE-79 Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php).
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892https://github.com/getgrav/grav/security/advisories/GHSA-269c-h76q-8cxwhttps://www.vulncheck.com/advisories/grav-before-stored-xss-via-quoted-attribute-bypasshttps://github.com/getgrav/grav/security/advisories/GHSA-269c-h76q-8cxw
2026-08-14
Published