CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.14 are vulnerable to a stored cross-site scripting (XSS) flaw due to improper handling of UTF-8 characters in the Security::detectXss() function, allowing authenticated attackers with page-edit permissions to inject malicious JavaScript. This vulnerability can lead to the execution of harmful scripts in the browsers of users visiting the compromised pages. Organizations using Grav should prioritize patching this issue to protect against potential exploitation and safeguard user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to return false for every pattern, silently bypassing the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions (without the security.xss_whitelist privilege) can store malicious JavaScript that executes in the browser of a visitor who views the affected page.