{"vulnerability": "ghsa-2c4f-86xc-cr74", "sightings": [{"uuid": "e3822e4f-8849-4335-b836-c0cfa003174d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2c4f-86xc-cr74", "type": "seen", "source": "https://gist.github.com/alon710/5ca87f854f57efb9963c43bcb0769b58", "content": "# CVE-2026-61453: CVE-2026-61453: Stored Cross-Site Scripting via Twig String Concatenation Bypass in Grav CMS\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61453\n\n## Summary\nGrav CMS before v2.0.1 contains a security bypass vulnerability in its blueprint validation logic. The XSS detection routine, Security::detectXss(), was executed on raw page contents prior to Twig engine processing. When Twig processing is enabled for editor-authored page content, an attacker can dynamically reconstruct harmful HTML elements, attributes, or protocols using string concatenation (e.g. `{{ 'on' ~ 'error' }}`). When compiled, the benign source converts into active XSS payloads, which are rendered to the client browser via raw filters. This vulnerability was resolved in version 2.0.1 by adding a post-render validation backstop.\n\n## TL;DR\nA stored XSS vulnerability in Grav CMS before v2.0.1 allows attackers with page-write permissions to bypass blueprint validation filters using Twig string concatenation. The vulnerability is fixed in version 2.0.1 by introducing a post-render scanning step.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.1 (Medium)\n- **EPSS Score**: 0.00263 (Percentile: 18.26%)\n- **Impact**: Stored Cross-Site Scripting (XSS) / Account Takeover\n- **Exploit Status**: PoC (Proof of Concept) available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Grav CMS installations prior to version 2.0.1\n- **grav**: < 2.0.1 (Fixed in: `2.0.1`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.1 or higher.\n- Disable Twig content processing (twig_content.process_enabled: false) if it is not required for editors.\n- Ensure the post-render XSS scanner config (twig_content.xss_scan_output: true) is enabled.\n\n**Remediation Steps:**\n1. Navigate to the system root directory of the Grav installation.\n2. Execute the update process using GPM: `bin/gpm selfupgrade`.\n3. Verify the installation version by running `bin/gpm index` and confirming it is at least 2.0.1.\n4. Open the configuration file `user/config/security.yaml`.\n5. Add or update the following parameters under `twig_content`:\n  `process_enabled: false` (or `true` if required)\n  `xss_scan_output: true`.\n6. Verify that your system logs do not report security anomalies in `logs/security.log`.\n\n## References\n\n- [GHSA-2c4f-86xc-cr74: XSS Bypass via Twig String Concatenation](https://github.com/getgrav/grav/security/advisories/GHSA-2c4f-86xc-cr74)\n- [Grav Commit - Patch for GHSA-2c4f-86xc-cr74](https://github.com/getgrav/grav/commit/6f619f0ae72cb64ea4daea1d0f050f740da347e6)\n- [VulnCheck Advisory: Grav XSS via Twig String Concatenation](https://www.vulncheck.com/advisories/grav-before-xss-via-twig-string-concatenation)\n- [CVE-2026-61453 CVERecord](https://www.cve.org/CVERecord?id=CVE-2026-61453)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61453) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T04:31:34.958174Z"}]}