Listen to this Post
The vulnerability exists in the `/admin/pages/
` endpoint of the Grav Admin Plugin prior to version 1.11.0-beta.1. Attackers with administrative access can inject malicious JavaScript payloads into specific parameters during page creation or editing, notably <code>data[bash][metadata]</code>, <code>data[bash][taxonomy][bash]</code>, and <code>data[bash][taxonomy][bash]</code>. These inputs are not properly sanitized before being stored in the page's frontmatter (the YAML header section of the file). When the compromised page is subsequently loaded and rendered within the Grav administrative interface, the stored malicious script is automatically executed in the context of the victim administrator's session. This stored cross-site scripting attack allows session hijacking, enabling the attacker to perform actions with the administrator's privileges without their consent. Platform: Grav Admin Plugin Version: < 1.11.0-beta.1 Vulnerability : Stored XSS Severity: Medium date: 12/01/2025 <h2 style="color: blue;">Prediction: Patched 2025-12-01</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] curl -X POST 'http://target/admin/pages/test' \ -H 'Cookie: grav-admin-session' \ --data 'data[bash][metadata]=<script>alert(document.cookie)</script>'
grep -r "taxonomy|metadata" ./user/pages/ --include=".md"
Input validation regex sed -i 's/<[^>]>//g' input_field
How Exploit:
Admin injects malicious script.
Script saved in page frontmatter.
Victim admin views page.
Script executes automatically.
Protection from this CVE
Update to 1.11.0-beta.1.
Implement output encoding.
Sanitize all user inputs.
Impact:
Admin account compromise.
Session hijacking possible.
Unauthorized administrative actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
