CVE-2026-61453
Received Received - Intake

Stored XSS in Grav CMS via Twig Template Processing

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description
Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-61453
EUVD
EUVD-2026-44650

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav to 2.0.1 (exc)
grav grav to 2.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61453 is a cross-site scripting (XSS) vulnerability in Grav CMS versions before 2.0.1. It allows attackers with page-write permissions to bypass the XSS validator by using Twig's string concatenation operator (~). The validator checks raw content before Twig processing, so malicious payloads like {% set x = "on" ~ "error" %} appear harmless initially. After Twig rendering, the output executes arbitrary JavaScript in visitors' browsers.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into web pages viewed by users. If exploited, it could lead to theft of session cookies, account takeovers, or defacement of the website. Users visiting compromised pages may have their data exposed or their browsers compromised.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Detection Guidance

To detect this vulnerability, check if your Grav CMS version is below 2.0.1. Inspect Twig templates and page content for use of the string concatenation operator (~). Look for payloads like onerror= or similar event handlers in rendered output. Review logs for unauthorized page modifications or suspicious API calls.

Mitigation Strategies

Upgrade Grav CMS to version 2.0.1 or later. Disable Twig content processing if not required. Remove the |raw filter from default themes to enforce proper escaping. Re-run the XSS validator on Twig output. Restrict page-write API permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart