Grav Admin Plugin EUVD-2025-200098

Requires an authenticated Grav administrator (PR:H) able to reach the admin panel and submit POST /admin/accounts/groups/[group] with a crafted data[readableName] (Display Name) value; the stored payload only executes when another user subsequently views the affected group or user configuration page (UI:A/UI:R), so a second victim's page load is required. Exploitation is limited to Grav installations running grav-plugin-admin prior to the fixed release and is not reachable by unauthenticated or anonymous visitors, which substantially narrows real-world risk to multi-admin or compromised-admin scenarios.

This is a genuine-but-low-priority stored XSS. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N with subsequent-system SC:H/SI:H/SA:H) scores 6.2 (Medium), and the high privilege requirement (PR:H) is the dominant limiting factor: the injectable /admin/accounts/groups/[group] endpoint sits inside the authenticated Grav admin panel, so an attacker must already hold admin-level access to write the malicious data[readableName] value. UI:A means a victim (another admin/user) must load the affected group/user page for the payload to fire. EPSS is very low at 0.04% (11th percentile) and there is no CISA KEV listing, so there is no signal of widespread automated exploitation - consistent with a flaw that requires prior admin authentication. A public PoC does exist (in the GHSA advisory, with a working <ScRipT>alert('PoC-XSS')</ScRipT> payload), but publicly available exploit code is a distinct signal from active exploitation and does not raise this to an urgent priority. Net: a real, confirmed, vendor-patched issue best treated as a privilege-boundary/defense-in-depth fix rather than an internet-facing emergency, because it is gated behind admin authentication and user interaction.

An attacker with admin-panel access (e.g., a low-trust co-administrator, or a hijacked admin session) edits a Grav group and sets the Display Name (data[readableName]) to a script payload, which is stored server-side. When another administrator later opens the Groups or Users view, the stored script executes in their browser session, enabling session/cookie theft or actions on their behalf. A working proof-of-concept is published in the GHSA-rmw5-f87r-w988 advisory.