Stored Cross-Site Scripting Vulnerability in Grav by GetGrav

CVE-2026-75834

What is CVE-2026-75834?

Grav, prior to version 2.0.14, is susceptible to a stored cross-site scripting (XSS) vulnerability found in the Security::detectXss() function. This flaw originates because all XSS detection patterns utilize the PCRE /u modifier for UTF-8, causing any invalid UTF-8 byte in the content to lead preg_match() to fail universally, thereby bypassing essential XSS protection mechanisms during saving. An authenticated attacker, possessing page-edit privileges but lacking the security.xss_whitelist privilege, can exploit this vulnerability to inject malicious JavaScript into the page. The harmful script will execute in the browser of any user who views the compromised page, posing a significant risk to web security.

References