CVE-2026-72832
Received Received - Intake

Stored XSS in Grav CMS via Security::detectXss()

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72832
EUVD
EUVD-2026-58646

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav From 1.5.2 (inc) to 2.0.12 (inc)
grav grav From 1.5.2 (inc) to 2.0.12 (inc)
grav grav 2.0.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72832 is a stored cross-site scripting (XSS) vulnerability in Grav, a content management system. It affects versions 1.5.2 through 2.0.12 due to a flaw in the Security::detectXss() function. The issue allows a page editor without admin.super privileges to inject malicious JavaScript by placing an event handler after a > character inside a quoted attribute. The detector scans for event handlers starting at < but fails to account for > characters within quoted attributes, causing the detector and browser to disagree on the HTML structure.

Detection Guidance

To detect this vulnerability, inspect Grav installations for versions between 1.5.2 and 2.0.12. Check for malicious payloads in page content, such as `<img src=x title=">" onerror=alert(document.domain)>` or similar patterns with event handlers after a `>` in quoted attributes.

Impact Analysis

This vulnerability allows an attacker with page editor privileges to inject malicious JavaScript into Grav pages. When visitors view the compromised page, the browser executes the injected script in the application's origin. This can lead to theft of session cookies, account takeover, or defacement of the website. The impact is severe as it affects all users viewing the stored page, including unauthenticated visitors.

Mitigation Strategies

Upgrade Grav to version 2.0.13 or later immediately. If upgrading is not possible, review and sanitize all user-submitted page content for malicious event handlers. Disable page editing privileges for untrusted users until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart