CVE-2026-100673 in Data Manager Plugin
Summary
by MITRE • 09/26/2026
The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Grav Data Manager plugin versions 1.0.1 through 1.4.4 constitutes a critical stored cross-site scripting flaw rooted in improper output encoding within the administrative interface. Specifically, the item-detail view located at admin/templates/partials/item.html.twig renders user-supplied data entries without applying adequate HTML entity escaping. Instead of sanitizing input for safe display, the template applies Twig's raw filter, which explicitly instructs the rendering engine to treat the content as trusted markup rather than plain text. This architectural decision creates a direct pathway for malicious scripts to be injected into the administrative context, bypassing standard browser security controls that rely on proper encoding to distinguish between code and data.
The mechanism of exploitation involves an unauthenticated attacker submitting a front-end form where submissions are persisted in user/data storage. The vulnerability is exacerbated by a flawed sanitization attempt using PHP's strip_tags function with empty allowed tags parameters. While the intent was likely to remove all HTML, this implementation fails because it preserves certain structural elements or attributes depending on the specific input vector, allowing an attacker to craft payloads that survive the stripping process and remain executable within the browser environment. This bypass technique leverages edge cases in how PHP handles tag parsing, ensuring that malicious JavaScript code remains intact despite superficial sanitization efforts.
The operational impact is severe due to the context of execution. When a system administrator opens the compromised entry in the classic admin panel, the stored payload executes automatically as JavaScript within the session and origin of that administrator account. For list values such as checkbox or multi-select fields, the script triggers immediately upon rendering. In cases involving ordinary text fields, execution occurs on hover events, requiring minimal user interaction to activate. Because this code runs with full administrative privileges and access to valid CSRF tokens, an attacker can perform any action available to a superuser. This includes modifying site configurations, creating new administrator accounts, exfiltrating sensitive data, or installing malicious plugins, effectively granting complete control over the Grav installation without requiring prior authentication credentials for the admin panel itself.
Industry standards classify this flaw under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter subcategories like JavaScript or HTML, where the adversary uses client-side scripting to execute commands within a victim's browser session. This classification highlights the risk of using stored data in privileged interfaces without rigorous validation, emphasizing that trust boundaries must be strictly enforced between user input and administrative output channels.
Mitigation strategies require immediate upgrading to Data Manager version 1.4.5 or later, where the rendering logic has been corrected to properly escape all dynamic content before display. For organizations unable to patch immediately due to dependency constraints, a temporary workaround involves implementing server-side sanitization that strictly removes all HTML tags and attributes from user-submitted data prior to storage in user/data files. Additionally, administrators should review recent form submissions for suspicious patterns and clear any cached views if the classic admin interface is still in use. It is important to note that sites utilizing the Grav 2.0 Admin Next interface are not affected by this specific vulnerability because they render data through a separate code path that correctly applies escaping mechanisms, providing an alternative layer of defense for those environments.