CVE-2026-100673
Deferred Deferred - Pending Action

Stored XSS in Grav Data Manager Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with that administrator's privileges and CSRF token. Execution occurs without further interaction for list values (such as checkbox or multi-select fields) and on hover for ordinary text fields. Sites using the Grav 2.0 Admin Next interface are not affected, because it renders the same data through a separate, correctly escaping code path. The issue is fixed in Data Manager 1.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100673
EUVD
EUVD-2026-87767

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-datamanager From 1.0.1 (inc) to 1.4.4 (inc)
getgrav grav-plugin-datamanager 1.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100673 is a stored cross-site scripting (XSS) vulnerability in the Grav Data Manager plugin versions 1.0.1 through 1.4.4. It occurs because the plugin renders stored data entries in the admin panel without proper escaping, using Twig's raw filter. Attackers can inject malicious JavaScript via front-end forms, which executes when an administrator views the entry in the classic admin panel. The vulnerability grants the attacker administrator privileges and CSRF tokens.

Detection Guidance

Check Grav Data Manager plugin versions 1.0.1 to 1.4.4. Inspect admin/templates/partials/item.html.twig for Twig raw filter usage and striptags('<br>') calls. Review user/data directory for suspicious HTML/JavaScript payloads in stored form submissions.

Impact Analysis

An unauthenticated attacker can exploit this to execute arbitrary JavaScript in the context of an administrator's session. This could lead to full account compromise, data theft, or unauthorized actions. The attack requires no special permissions and can be triggered by viewing a malicious entry in the admin panel. List-type fields may execute payloads automatically, while text fields may require hover interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. A successful exploit may result in data breaches, unauthorized modifications, or disclosure of protected health information, potentially leading to regulatory penalties and loss of compliance certifications.

Mitigation Strategies

Update Grav Data Manager plugin to version 1.4.5 or later. Restrict admin.data-manager permission if update is not possible. Migrate to Grav 2.0 with Admin Next. Review and remove malicious payloads from user/data directory after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart