CVE-2026-85598 in Grav
Summary
by MITRE • 09/04/2026
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Grav content management system versions 2.0.0 through 2.0.17 represents a significant security flaw rooted in inconsistent input validation and sanitization logic within the application's modular page handling mechanisms. While the core platform implements robust cross-site scripting (XSS) detection during standard save operations to prevent malicious script injection, this protective measure was inadvertently bypassed for modular pages. This architectural inconsistency allows authenticated users with page-editing privileges to inject Twig-assembled XSS payloads directly into modular components. The flaw stems from a failure in the application's security middleware or validation layer to uniformly apply sanitization rules across all content types, specifically neglecting the specialized processing pipeline used for modular structures within the Grav framework.
From an operational perspective, this vulnerability enables stored cross-site scripting attacks that persist on the server side until manually removed by an administrator. An attacker with legitimate editing rights can craft a modular page containing malicious Twig code designed to execute arbitrary JavaScript in the context of any user viewing the parent page. This execution occurs during the rendering phase when the web application processes and outputs the HTML content to the visitor's browser. The severity is amplified because the payload executes not only for regular site visitors but also within administrator sessions, potentially allowing an attacker with lower-level privileges to escalate their influence by stealing administrative cookies or session tokens through malicious scripts injected into admin-facing views.
The technical impact of this flaw aligns closely with CWE-79, which classifies improper neutralization of input during web page generation as a common cause of cross-site scripting vulnerabilities. By leveraging Twig templating engine capabilities to assemble and execute JavaScript payloads, the attacker exploits the trust relationship between the application's rendering engine and its users. This scenario is further contextualized by MITRE ATT&CK technique T1059.007, which covers command and script interpretation via web shells or injected scripts, as well as T1089, Disabling Security Tools, if the payload is designed to interfere with browser-based security features like Content Security Policy enforcement or cookie flags. The ability to execute code in administrative sessions also touches upon privilege escalation vectors where lower-privileged accounts can perform actions typically reserved for high-level administrators by manipulating session data or performing unauthorized API calls via injected scripts.
Mitigation strategies must prioritize immediate patching of the Grav installation to version 2.0.18 or later, which addresses this specific inconsistency in modular page processing. In environments where upgrading is not immediately feasible, administrators should enforce strict role-based access control (RBAC) policies to limit page-editing privileges to only those users who absolutely require them, thereby reducing the attack surface for potential insider threats or compromised accounts. Additionally, implementing a robust Content Security Policy (CSP) header can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute, although this is considered a compensating control rather than a fix for the underlying code defect. Regular security audits and static application security testing should be integrated into the development lifecycle to ensure that input validation logic remains consistent across all content types and modules within the CMS architecture.