Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72832Grav before 2.0.13 Stored XSS via quoted-attribute bypass

Medium 5.4

In plain English

A medium-severity cross-site scripting in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=">" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.13	GHSA-269c-h76q-8cxw

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	1.5.2 – through 2.0.12

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-269c-h76q-8cxw) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Grav before 2.0.13 Stored XSS via quoted-attribute bypass third-party-advisory