{"uuid": "ae753e37-78b7-4c53-928e-7fe4e5dd794b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-q2j8-x8hf-63ch", "type": "seen", "source": "https://gist.github.com/alon710/ad6e1e5488ae59b7f526abb734e7c86a", "content": "# CVE-2026-75834: CVE-2026-75834: Input Sanitization Bypass leading to Stored XSS in Grav CMS\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75834\n\n## Summary\nCVE-2026-75834 is a stored Cross-Site Scripting (XSS) vulnerability in Grav CMS core, caused by a design flaw in its input validation wrapper Security::detectXss(). Regular expressions using the PCRE UTF-8 /u modifier fail-open when encountering invalid UTF-8 sequences or when the PCRE JIT stack limit is exhausted, allowing authenticated users with page-editing privileges to save malicious HTML and scripts.\n\n## TL;DR\nA critical security bypass in Grav CMS's XSS safety gate allows attackers to inject and store arbitrary HTML/JavaScript by passing invalid UTF-8 bytes or oversized elements, triggering silent engine failures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (Authenticated Page-Edit Permissions Required)\n- **CVSS v3.1 Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00182 (0.18% Probability)\n- **Impact**: Stored Cross-Site Scripting (XSS) / Account Takeover\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Grav CMS Core\n- **grav**: < 2.0.14 (Fixed in: `2.0.14`)\n\n## Mitigation\n\n- Upgrade core Grav CMS deployment to version 2.0.14 or above\n- Apply strict input validation on markdown file writes via WAF filters\n- Run server-side sweeps to detect broken encoding formats in site text storage\n\n**Remediation Steps:**\n1. Review user directories for modifications executed inside pages containing non-ASCII values\n2. Update system dependencies and apply commit 5192316f5bf0f033636f43561829d7fc13a4ab64 manually if pinned to an older version\n3. Enforce multi-factor authentication and role limits for editor-level profiles\n\n## References\n\n- [GitHub Security Advisory GHSA-q2j8-x8hf-63ch](https://github.com/getgrav/grav/security/advisories/GHSA-q2j8-x8hf-63ch)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/grav-before-stored-xss-via-invalid-utf-8-byte)\n- [Remediation Commit](https://github.com/getgrav/grav/commit/5192316f5bf0f033636f43561829d7fc13a4ab64)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75834) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T23:31:57.279014Z"}