GHSA-cchq-397m-q2qm
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | getgrav/grav | <= 1.7.49 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS). The page editor allows authenticated users to edit page content via a Markdown editor. The editor fails to properly sanitize <script> tags, allowing stored XSS payloads to execute when pages are viewed in the admin interface.
References
External links from the advisory. They lead to third-party sites.