Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 14 Aug 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13. | |
| Title | Grav before 2.0.12 Stored XSS via quoted-attribute bypass | |
| First Time appeared |
Getgrav
Getgrav grav |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:getgrav:grav:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53.1:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53.2:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:1.7.53:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:-:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc10:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc6:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc7:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc8:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.0:rc9:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.10:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.6:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.7:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.8:*:*:*:*:*:*:* cpe:2.3:a:getgrav:grav:2.0.9:*:*:*:*:*:*:* |
|
| Vendors & Products |
Getgrav
Getgrav grav |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-08-14T11:35:38.484Z
Reserved: 2026-08-10T15:13:41.486Z
Link: CVE-2026-72832
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses