CVE-2026-75828: Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Grav installations running versions before 2.0.15 are affected when authenticated editors can create or modify page content that is rendered to visitors. Visitors who view the injected content may have attacker-controlled script execute in their browsers.
What access and conditions are required to exploit this?
An attacker needs authenticated editor-level access and must be able to submit crafted content containing an unpaired quote in an unquoted attribute value. Exploitation also requires a visitor to render the malicious page content.
What should teams do if they cannot patch immediately?
Update Grav to version 2.0.15 or later. If upgrading cannot happen immediately, restrict editor access to trusted users and review recently created or modified page content for injected event-handler attributes such as onerror=.