{"uuid": "27aded79-ad57-4645-85d8-4577ec73f2fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75828", "type": "seen", "source": "https://gist.github.com/alon710/921970bf6a85809e6ae612195bf792e8", "content": "# CVE-2026-75828: CVE-2026-75828: Stored Cross-Site Scripting (XSS) via Security Filter Bypass in Grav CMS\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75828\n\n## Summary\nCVE-2026-75828 is a critical stored cross-site scripting (XSS) vulnerability in the getgrav Grav CMS before version 2.0.15. The vulnerability resides in the detectXss() security filter mechanism, where parser-differential mismatches between the regular-expression-based server-side validation and browser HTML5 tokenization allow authenticated editors to bypass event-handler detection and inject arbitrary JavaScript execution vectors.\n\n## TL;DR\nA parser-differential flaw in Grav CMS's detectXss() filter allows authenticated editors to bypass event-handler detection using unpaired quotes in unquoted attribute values, resulting in stored cross-site scripting.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: 0.00343\n- **Impact**: Stored Cross-Site Scripting (XSS) leading to Session Hijacking / RCE\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS\n- **grav**: < 2.0.15 (Fixed in: `2.0.15`)\n\n## Mitigation\n\n- Upgrade the Grav Core installation to version 2.0.15 or higher.\n- Apply the regex hotfix to system/src/Grav/Common/Security.php to anchor quote matching to the assignment operator.\n- Implement Web Application Firewall (WAF) inspection to reject payload sequences containing malformed HTML tags.\n\n**Remediation Steps:**\n1. Navigate to the Grav root directory on the hosting server.\n2. Execute the CLI self-upgrade command: bin/gpm self-upgrade\n3. Verify the version in system/src/Grav/Common/Security.php to ensure the updated regex configurations are active.\n\n## References\n\n- [Grav GitHub Security Advisory](https://github.com/getgrav/grav/security/advisories/GHSA-vfmf-q6x9-cw96)\n- [VulnCheck Third-Party Advisory](https://www.vulncheck.com/advisories/grav-before-stored-xss-via-detectxss-quote-bypass)\n- [Grav Core Security Fix Commit](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd)\n- [Raw Git Patch Reference](https://github.com/getgrav/grav/commit/d5f89d95d94cc155bc3be998ee85527a7be073dd.patch)\n- [Official CVE Entry](https://www.cve.org/CVERecord?id=CVE-2026-75828)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75828) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T01:31:36.584153Z"}