CVE-2026-61453: Stored Cross-Site Scripting via Twig String Concatenation Bypass in Grav CMS

Vulnerability ID: CVE-2026-61453
CVSS Score: 6.1
Published: 2026-09-16

Grav CMS before v2.0.1 contains a security bypass vulnerability in its blueprint validation logic. The XSS detection routine, Security::detectXss(), was executed on raw page contents prior to Twig engine processing. When Twig processing is enabled for editor-authored page content, an attacker can dynamically reconstruct harmful HTML elements, attributes, or protocols using string concatenation (e.g. {{ 'on' ~ 'error' }}). When compiled, the benign source converts into active XSS payloads, which are rendered to the client browser via raw filters. This vulnerability was resolved in version 2.0.1 by adding a post-render validation backstop.

TL;DR

A stored XSS vulnerability in Grav CMS before v2.0.1 allows attackers with page-write permissions to bypass blueprint validation filters using Twig string concatenation. The vulnerability is fixed in version 2.0.1 by introducing a post-render scanning step.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network
• CVSS v3.1 Score: 6.1 (Medium)
• EPSS Score: 0.00263 (Percentile: 18.26%)
• Impact: Stored Cross-Site Scripting (XSS) / Account Takeover
• Exploit Status: PoC (Proof of Concept) available
• CISA KEV Status: Not Listed

Affected Systems

• Grav CMS installations prior to version 2.0.1
• grav: < 2.0.1 (Fixed in: 2.0.1)

Code Analysis

Commit: 6f619f0

Fix XSS blueprint validation bypass by running a post-render XSS detector on the rendered output of editor-authored Twig content.

Mitigation Strategies

• Upgrade Grav CMS to version 2.0.1 or higher.
• Disable Twig content processing (twig_content.process_enabled: false) if it is not required for editors.
• Ensure the post-render XSS scanner config (twig_content.xss_scan_output: true) is enabled.

Remediation Steps:

1. Navigate to the system root directory of the Grav installation.
2. Execute the update process using GPM: bin/gpm selfupgrade.
3. Verify the installation version by running bin/gpm index and confirming it is at least 2.0.1.
4. Open the configuration file user/config/security.yaml.
5. Add or update the following parameters under twig_content: process_enabled: false (or true if required) xss_scan_output: true.
6. Verify that your system logs do not report security anomalies in logs/security.log.

References

• GHSA-2c4f-86xc-cr74: XSS Bypass via Twig String Concatenation
• Grav Commit - Patch for GHSA-2c4f-86xc-cr74
• VulnCheck Advisory: Grav XSS via Twig String Concatenation
• CVE-2026-61453 CVERecord

Read the full report for CVE-2026-61453 on our website for more details including interactive diagrams and full exploit analysis.