Stored Cross-Site Scripting Vulnerability in Grav Admin by GetGrav

CVE-2026-85600

What is CVE-2026-85600?

Versions of Grav Admin prior to 2.0.21 are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises in the tHtml() function where untrusted parameters, such as usernames, are injected into translation templates without appropriate sanitization. Although Grav's server-side username validation restricts certain filesystem-related characters, it fails to filter out HTML entities, allowing an attacker to register a username with an embedded HTML payload. When an administrator interacts with user interfaces that display these usernames—such as confirmation prompts or editor notices—the injected script can execute within their authenticated session, potentially leading to unauthorized actions and data exposure.

References