Grav Admin Plugin XSS and Information Disclosure

Stored cross-site scripting in the Grav Admin plugin (all versions prior to 1.11.0-beta.1) lets an authenticated administrator inject arbitrary JavaScript through the data[readableName] (Display Name) field of a user group, which is then persisted server-side and executed in the browser of any other user who later opens the affected group or user configuration page. The vulnerability is reachable only by a high-privileged, already-authenticated admin (CVSS v4 vector PR:H, and the independent assessment's CVSS:3.1 PR:H/UI:R), so exploitation hinges on a second victim loading the poisoned page and is effectively limited to multi-admin or compromised-admin scenarios. Publicly available exploit code exists, including a published proof-of-concept payload, but there is no indication of active exploitation; EPSS is very low at 0.04% (11th percentile), and the vendor has released a fixed version.

Stored cross-site scripting (XSS) in the Grav Admin plugin prior to 1.11.0-beta.1 allows an authenticated administrator with page create/edit rights to inject malicious JavaScript into the data[header][metadata], data[header][taxonomy][category], or data[header][taxonomy][tag] fields of the POST /admin/pages/[page] endpoint; the payload is persisted in the page's YAML frontmatter and executes in the browser of any privileged user who later opens or renders that page in the admin interface. Exploitation requires a valid admin account (PR:H) and a second privileged user to view the poisoned page (UI:A), and publicly available exploit code exists in the form of a documented proof-of-concept payload, though EPSS is very low at 0.04% (11th percentile) and there is no confirmed active exploitation (CISA KEV). Impact is limited to client-side compromise of admin sessions - session/cookie theft, credential phishing, and CSRF-style actions on behalf of the victim - rather than server-side code execution.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. This vulnerability is fixed in 1.11.0-beta.1.

A security vulnerability in This admin (CVSS 6.5). Risk factors: public PoC available. Vendor patch is available.