Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75834Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte

Medium 5.4

In plain English

A medium-severity cross-site scripting in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to return false for every pattern, silently bypassing the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions (without the security.xss_whitelist privilege) can store malicious JavaScript that executes in the browser of a visitor who views the affected page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.14	GHSA-q2j8-x8hf-63ch

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.14

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-q2j8-x8hf-63ch) vendor-advisory
VulnCheck Advisory: Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte third-party-advisory