CVE-2026-85598: Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent page is rendered, including in administrator sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
After upgrading Grav to 2.0.18, review modular pages for any stored Twig-assembled XSS payloads and remove them as needed, especially those that could execute when parent pages render (including in administrator sessions).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated page-editor rights in Grav. They must be able to create or modify modular pages and include malicious Twig-assembled content.
Who is exposed when a malicious modular page is rendered?
Visitors to the parent page can have the stored payload execute in their browsers. This includes administrators who render the affected parent page in an administrative session.
Are standard page types affected?
The issue is specifically described as missing save-time XSS detection for modular pages. The provided information does not establish that non-modular page types are affected.
How can I identify potentially affected content?
Review modular pages created or edited by users with page-edit rights for Twig-assembled content or unexpected script-like payloads. Pay particular attention to modular pages whose parent pages are viewed by administrators.