GHSA-7G78-5G5G-MVFJ
Vulnerability from github – Published: 2025-12-02 01:24 – Updated: 2025-12-02 01:24Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.
Details
Vulnerable Endpoint: POST /admin/pages/[page]
Parameter: data[header][template]
The application fails to properly sanitize user input in the data[header][template] field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.
PoC
Payload:
<script>alert('PoC-XXS73')</script>
Steps to Reproduce:
-
Log in to the Grav Admin Panel and navigate to Pages.
-
Create a new page or edit an existing one.
-
In the Advanced > Template field (which maps to
data[header][template]), insert the payload: -
Save the page.
-
Return to the Pages section and click on the three-dot menu of the affected page:
-
The stored XSS payload is triggered, and the script is executed in the browser:
Impact
Stored XSS vulnerabilities can have serious consequences, including:
-
Session hijacking: Capturing admin session cookies or tokens
-
Malware delivery: Executing scripts that load malicious resources
-
Credential theft: Creating fake login prompts to steal usernames/passwords
-
Data exposure: Reading sensitive metadata or page contents
-
Privilege escalation: Performing actions as an authenticated user
-
Website defacement: Altering visual or functional elements of the site
-
Reputation damage: Undermining user trust in the application
by CVE-Hunters
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.0-beta.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66310"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-02T01:24:56Z",
"nvd_published_at": "2025-12-01T22:15:51Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nA Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][template]` parameter. The script is saved within the page\u0027s frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.\n\n---\n\n## Details\n\n**Vulnerable Endpoint:** `POST /admin/pages/[page]` \n**Parameter:** `data[header][template]`\n\nThe application fails to properly sanitize user input in the `data[header][template]` field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.\n\n---\n\n## PoC\n\n**Payload:**\n\n`\u003cscript\u003ealert(\u0027PoC-XXS73\u0027)\u003c/script\u003e`\n\n### Steps to Reproduce:\n\n1. Log in to the _Grav_ Admin Panel and navigate to **Pages**.\n \n2. Create a new page or edit an existing one.\n \n3. In the **Advanced \u003e Template** field (which maps to `data[header][template]`), insert the payload:\n\n\n4. Save the page.\n \n5. Return to the **Pages** section and click on the **three-dot menu** of the affected page: \n\n\n6. The stored XSS payload is triggered, and the script is executed in the browser:\n\n---\n\n## Impact\n\nStored XSS vulnerabilities can have serious consequences, including:\n\n- **Session hijacking:** Capturing admin session cookies or tokens\n \n- **Malware delivery:** Executing scripts that load malicious resources\n \n- **Credential theft:** Creating fake login prompts to steal usernames/passwords\n \n- **Data exposure:** Reading sensitive metadata or page contents\n \n- **Privilege escalation:** Performing actions as an authenticated user\n \n- **Website defacement:** Altering visual or functional elements of the site\n \n- **Reputation damage:** Undermining user trust in the application\n\nby\u00a0[CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)",
"id": "GHSA-7g78-5g5g-mvfj",
"modified": "2025-12-02T01:24:56Z",
"published": "2025-12-02T01:24:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66310"
},
{
"type": "WEB",
"url": "https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.