https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:09:01 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-72832 <p>Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`; when a `&gt;` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `&lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt;`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.</p> <p>Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`; when a `&gt;` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `&lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt;`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-72832 https://vulnerability.circl.lu/vuln/ghsa-269c-h76q-8cxw <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A page editor without `admin.super` can place an event handler after a `&gt;` inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.</p> <p>### Details</p> <p>`Security::detectXss()` (`system/src/Grav/Common/Security.php:253`) anchors the `on_events` scan at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`. When that character is inside a quoted value, the browser keeps the tag open and parses the later `onerror` attribute, so the detector and browser disagree. `AdminController::savePage()` relies on this detector when saving content from page editors outside the `admin.super` whitelist.</p> <p>### PoC</p> <p>I reproduced this with `getgrav/grav` 2.0.11 (`ad9709f865b09b68798fb1ac375b484a8cc1d892`), Admin 1.10.52, and Quark 2 1.1.4.</p> <p>1. Sign in as a user with `admin.login` and `admin.pages`, but without `admin.super`. 2. Create or edit `/xsstest` and save this page body:</p> <p>```html &lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt; ```</p> <p>3. Open `/xsstest` in a private browser window.</p> <p>The save succeeds and the visitor sees an alert containing the site domain. With the body changed to `&lt;img src=x onerror=alert(1)&gt;`, the same endpoint rejects it with `XSS issue detected` and does not store it.</p> <p>### Impact</p> <p>A page editor can execute JavaScript in the origin of every user who views the stored page, including unauthenticated visitors.</p> <p>### Anticipated objection and response</p> <p>Although the `detectXss…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>### Summary</p> <p>A page editor without `admin.super` can place an event handler after a `&gt;` inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.</p> <p>### Details</p> <p>`Security::detectXss()` (`system/src/Grav/Common/Security.php:253`) anchors the `on_events` scan at `&lt;` and uses `[^&gt;]*?`, which cannot cross the first literal `&gt;`. When that character is inside a quoted value, the browser keeps the tag open and parses the later `onerror` attribute, so the detector and browser disagree. `AdminController::savePage()` relies on this detector when saving content from page editors outside the `admin.super` whitelist.</p> <p>### PoC</p> <p>I reproduced this with `getgrav/grav` 2.0.11 (`ad9709f865b09b68798fb1ac375b484a8cc1d892`), Admin 1.10.52, and Quark 2 1.1.4.</p> <p>1. Sign in as a user with `admin.login` and `admin.pages`, but without `admin.super`. 2. Create or edit `/xsstest` and save this page body:</p> <p>```html &lt;img src=x title=&#34;&gt;&#34; onerror=alert(document.domain)&gt; ```</p> <p>3. Open `/xsstest` in a private browser window.</p> <p>The save succeeds and the visitor sees an alert containing the site domain. With the body changed to `&lt;img src=x onerror=alert(1)&gt;`, the same endpoint rejects it with `XSS issue detected` and does not store it.</p> <p>### Impact</p> <p>A page editor can execute JavaScript in the origin of every user who views the stored page, including unauthenticated visitors.</p> <p>### Anticipated objection and response</p> <p>Although the `detectXss…</p> https://vulnerability.circl.lu/vuln/ghsa-269c-h76q-8cxw