CVE-2026-72832 in Grav
Summary
by MITRE • 08/14/2026
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability identified in Grav versions 1.5.2 through 2.0.12 represents a critical stored cross-site scripting flaw within the Security::detectXss() function located in system/src/Grav/Common/Security.php. This security weakness stems from an inadequate input validation mechanism that fails to properly sanitize user-supplied content before storage and subsequent execution. The flaw manifests when the event-handler scan pattern is anchored at the less-than character `<` and employs the regex pattern `[^>]*?` which cannot traverse beyond the initial literal `>` character. This fundamental limitation in the regular expression logic creates a parsing discrepancy between the security detector and the web browser's rendering engine, allowing malicious payloads to bypass detection mechanisms.
The technical implementation of this vulnerability exploits the way browsers handle malformed HTML attributes containing embedded greater-than characters within quoted attribute values. When a browser encounters an HTML tag such as `<img src=x title=">" onerror=alert(document.domain)>`, it maintains the tag as open due to the unescaped `>` character inside the quoted title attribute. This browser behavior causes subsequent event handlers like `onerror` to be parsed and executed within the context of the page, effectively transforming what should be a benign attribute value into an executable script payload. The security detector fails to recognize this scenario because its regex pattern cannot properly account for the nested parsing behavior that occurs in actual browser rendering, creating a mismatch between detection logic and real-world execution contexts.
The operational impact of this vulnerability is severe as it allows unauthenticated attackers to execute arbitrary JavaScript code within the context of any website running affected Grav versions. Page editors without admin.super privileges can craft malicious content that appears legitimate to the security scanner but executes harmful scripts when viewed by visitors. This means that even users with minimal permissions can potentially compromise entire websites, leading to session hijacking, data theft, or full site takeover scenarios. The vulnerability affects all visitors including anonymous users who simply navigate to pages containing the malicious content, making it particularly dangerous for public-facing websites where any user input is processed and stored.
The remediation for this vulnerability was implemented in Grav version 2.0.13 through enhanced input validation that properly handles attribute parsing scenarios and accounts for browser behavior when encountering malformed HTML structures. Organizations should immediately upgrade to the patched version to eliminate the risk of exploitation. Additional mitigations include implementing strict content filtering policies, restricting user permissions to prevent unauthorized content creation, and deploying web application firewalls with advanced XSS detection capabilities. This vulnerability aligns with CWE-79 (Cross-site Scripting) and maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) within the adversary tactics framework, demonstrating how poorly implemented security controls can enable persistent attack vectors against web applications.