Executive Summary

CVE-2025-66843 is a Stored Cross-Site Scripting (Stored XSS) vulnerability in Grav CMS before version 1.7.49.5. An authenticated user with low privileges who can edit content can inject malicious JavaScript code into editable fields on a page. This malicious code is stored on the server and later executed in the browsers of any users who view or edit the affected page. The vulnerability exists because the application does not properly sanitize or escape user-supplied HTML content during page editing, allowing attackers to insert harmful scripts that run in other users' browser sessions. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to several serious impacts including session hijacking, theft of cookies, extraction of CSRF tokens, and execution of arbitrary JavaScript code as another user. If an administrator views the infected page, the attacker could perform unauthorized administrative actions. Additionally, it can be used for defacement or phishing attacks by injecting malicious scripts. Exploitation does not require any privileges beyond the ability to edit page content. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection involves identifying pages edited by low-privileged users that contain suspicious HTML elements with JavaScript event handlers. You can search the Grav CMS content files for injected payload patterns such as '<svg onload=', '<img src=x onerror=', or similar event attributes. For example, use grep commands on the Grav pages directory to find these patterns: grep -r -E '<svg onload=|<img src=x onerror=|<video src=x onerror=' user/pages/. This helps locate stored malicious scripts injected via page editing. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting page editing permissions to trusted users only, reviewing and cleaning existing content for injected malicious scripts, and applying input sanitization or escaping on user-supplied HTML content during page editing. Additionally, updating Grav CMS to a version later than v1.7.49.5 once a patch is available is recommended to fix the vulnerability at the application level. [1]

Useful 0 Not Useful 0