Grav Data Manager CVE-2026-100673

Requires the target Grav site to (1) run the Data Manager plugin version 1.0.1 through 1.4.4, (2) route front-end form submissions into the user/data store so an unauthenticated visitor can create a stored entry, and (3) use the classic Grav admin panel - sites using the Grav 2.0 Admin Next interface are NOT affected because it renders the same data through a correctly-escaping path. Payload triggering requires an administrator to open the malicious entry in the item-detail view: for list-type values (checkbox/multi-select) execution occurs on view with no further interaction, while for ordinary text fields it triggers on hover. The initial injection itself needs no authentication.

This is a genuine, moderately-high-risk stored XSS that crosses a privilege boundary. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N with subsequent-system SC:H/SI:L) scores 8.4 and is defensible: the initial injection is remote and unauthenticated (PR:N) because the payload is stored via an ordinary front-end form, and the passive user interaction (UI:P) reflects the administrator merely opening/viewing the entry - which for list/checkbox/multi-select fields fires with no action at all and for text fields fires on hover. The high subsequent-system confidentiality impact (SC:H) captures full compromise of the admin session in the classic admin panel, including the CSRF token, enabling attacker actions with administrator privileges. No exploitation-probability signals reinforce urgency: there is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis - so this is a real priority driven by impact and low exploitation barrier, not by observed in-the-wild activity. Two limiting factors temper the raw score: the site must actually route front-end form submissions into user/data via Data Manager, and it must use the classic admin panel - the Grav 2.0 Admin Next interface is explicitly not affected because it escapes correctly.

An attacker submits a public front-end form on a Grav site whose entries are stored to user/data, placing a crafted HTML/JavaScript payload (e.g. in a checkbox or multi-select value) into a saved data entry. When an administrator later opens that entry in the classic admin panel's item-detail view, the unescaped raw-filtered value executes as JavaScript in the admin's session and origin - automatically for list values, on hover for text fields. No public exploit code is currently identified, but the technique (Twig raw plus a strip_tags allowed-tag/attribute bypass) is straightforward to reproduce.