Listen to this Post
The CVE-2025-66310 vulnerability operates through a Stored Cross-Site Scripting (XSS) mechanism in the Grav admin plugin, specifically targeting the `/admin/pages/
` endpoint. When an authenticated admin user creates or modifies a page, the application accepts input via the `data[bash][template]` parameter without adequate sanitization. Attackers can inject malicious JavaScript code into this parameter, which is then persistently stored within the page's frontmatter—the YAML header section of the page file. This injected script becomes part of the page configuration and is saved to the server. Upon subsequent access, whether when the page is rendered in the administrative interface for editing or when viewed on the frontend, the stored script is automatically executed in the browser of any user who loads that page. The execution occurs with the privileges of the victim user, potentially leading to session hijacking, credential theft, or defacement. Although exploitation requires admin-level access to the plugin, once injected, the payload affects all users viewing the compromised page, amplifying the risk. The vulnerability stems from insufficient input validation and output encoding, allowing script tags to be interpreted as code rather than inert text. The fix in version 1.11.0-beta.1 addresses this by implementing proper sanitization routines that escape or reject dangerous inputs, thereby neutralizing the injection vector.
Platform: Grav Admin Plugin
Version: Pre-1.11.0-beta.1
Vulnerability: Stored XSS
Severity: Medium
Date: 12/01/2025
<h2 style="color: blue;">Prediction: Patched 1.11.0-beta.1</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
[bash]
curl -X POST -H "Cookie: admin_session" -d "data[bash][template]=<script>alert('XSS')</script>" http://grav-site/admin/pages/test
grep -r "template:" /path/to/grav/pages --include=".md"
// Example vulnerable frontmatter in page.md template: <script>malicious_code()</script>
How Exploit:
Inject script via template parameter; stored in frontmatter; auto-executes on page render.
Protection from this CVE:
Update to 1.11.0-beta.1; sanitize inputs; implement Content Security Policy.
Impact:
Session hijacking; admin compromise; site defacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
