CVE-2026-75834: Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte
Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch() to return false for every pattern, silently bypassing the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions (without the security.xsswhitelist privilege) can store malicious JavaScript that executes in the browser of a visitor who views the affected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Instances running Grav before 2.0.14 are affected when a user has authenticated page-edit permissions. The attacker does not need the security.xss_whitelist privilege.
What must an attacker do to trigger the stored XSS?
Exploitation requires the attacker to save page content containing an invalid UTF-8 byte along with malicious JavaScript. The script executes when another user visits the affected page, so user interaction is required from the victim.
What can be done if patching is not immediately possible?
Update Grav to version 2.0.14 or later. If updating cannot occur immediately, restrict page-edit permissions to trusted users and review recently edited page content for invalid UTF-8 bytes and injected script content.