Listen to this Post
How the CVE Works:
The vulnerability exists in the `/admin/config/site` endpoint of the Grav admin plugin prior to version 1.11.0-beta.1. This endpoint handles the site’s configuration, including its taxonomies. The application fails to properly sanitize user input for the `data
` parameter during configuration saves. An authenticated attacker with admin privileges can submit a crafted payload containing malicious JavaScript within this parameter. The server stores this tainted configuration in its data files. Subsequently, whenever any user, including regular visitors, accesses the site's frontend where taxonomies are rendered, or an administrator loads the site configuration panel in the admin interface, the stored malicious script is served and automatically executed in the victim's browser. This creates a persistent cross-site scripting attack vector from a single admin-level injection.
Platform: Grav CMS
Version: <1.11.0-beta.1
Vulnerability: Stored XSS
Severity: Medium
Date: 2025-12-01
<h2 style="color: blue;">Prediction: Patched available.</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
[bash]
Check installed plugin version
bin/gpm info admin
Review site configuration YAML file
cat user/config/site.yaml | grep -i taxonomies
Curl example to test endpoint (requires admin session)
curl -X POST 'https://target.com/admin/config/site' \
-H 'Content-Type: application/json' \
-b 'grav-site-<hash>=<session_cookie>' \
--data '{"data":{"taxonomies":["cat1","cat2\"><script>alert(document.domain)</script>"]}}'
How Exploit:
1. Attacker logs into Grav admin panel.
2. Navigates to Configuration -> Site settings.
3. Injects malicious script into taxonomies field.
4. Saves configuration, payload stores on server.
5. Victim visits site, script executes automatically.
Protection from this CVE
Update to version 1.11.0-beta.1 or later. Implement strict Content Security Policy headers. Sanitize all user-controlled input before rendering.
Impact:
Session hijacking, admin credential theft, defacement, malware distribution via admin interface.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
