CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS

Vulnerability ID: CVE-2026-75828
CVSS Score: 9.3
Published: 2026-09-17

CVE-2026-75828 is a critical stored cross-site scripting (XSS) vulnerability in the getgrav Grav CMS before version 2.0.15. The vulnerability resides in the detectXss() security filter mechanism, where parser-differential mismatches between the regular-expression-based server-side validation and browser HTML5 tokenization allow authenticated editors to bypass event-handler detection and inject arbitrary JavaScript execution vectors.

TL;DR

A parser-differential flaw in Grav CMS's detectXss() filter allows authenticated editors to bypass event-handler detection using unpaired quotes in unquoted attribute values, resulting in stored cross-site scripting.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network
• CVSS Score: 9.3 (Critical)
• EPSS Score: 0.00343
• Impact: Stored Cross-Site Scripting (XSS) leading to Session Hijacking / RCE
• Exploit Status: Proof of Concept
• KEV Status: Not Listed

Affected Systems

• Grav CMS
• grav: < 2.0.15 (Fixed in: 2.0.15)

Code Analysis

Commit: d5f89d9

Fix XSS vulnerability in detectXss() by anchoring quote parsing to assignment operator.

Exploit Details

• GitHub Security Advisory: Official advisory with details of the quote bypass vulnerability.

Mitigation Strategies

• Upgrade the Grav Core installation to version 2.0.15 or higher.
• Apply the regex hotfix to system/src/Grav/Common/Security.php to anchor quote matching to the assignment operator.
• Implement Web Application Firewall (WAF) inspection to reject payload sequences containing malformed HTML tags.

Remediation Steps:

1. Navigate to the Grav root directory on the hosting server.
2. Execute the CLI self-upgrade command: bin/gpm self-upgrade
3. Verify the version in system/src/Grav/Common/Security.php to ensure the updated regex configurations are active.

References

• Grav GitHub Security Advisory
• VulnCheck Third-Party Advisory
• Grav Core Security Fix Commit
• Raw Git Patch Reference
• Official CVE Entry

Read the full report for CVE-2026-75828 on our website for more details including interactive diagrams and full exploit analysis.