CVE-2025-66312
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Grav's admin plugin allows attackers to inject malicious scripts into group names. When administrators view the affected groups page, the scripts execute automatically, potentially compromising admin sessions. This affects Grav installations using the admin plugin before version 1.11.0-beta.1.
💻 Affected Systems
- Grav CMS with Admin Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal admin session cookies, perform actions as administrators, install backdoors, or redirect users to malicious sites, potentially leading to complete system compromise.
Likely Case
Attackers with admin access could inject persistent scripts that steal credentials or session tokens from other administrators viewing the groups page.
If Mitigated
With proper input validation and output encoding, malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires admin-level access to the /admin/accounts/groups/ endpoint to inject malicious payloads into the data[readableName] parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.0-beta.1
Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-rmw5-f87r-w988
Restart Required: No
Instructions:
1. Update Grav admin plugin to version 1.11.0-beta.1 or later. 2. Run 'bin/gpm update' from Grav root directory. 3. Clear Grav cache if needed.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize HTML/JavaScript in group names
Implement custom validation in Grav plugins to strip script tags from group name inputs
Output Encoding
allApply proper output encoding when displaying group names in admin interface
Modify admin plugin templates to use htmlspecialchars() or equivalent when outputting group names
🧯 If You Can't Patch
- Restrict access to the admin interface using IP whitelisting or VPN
- Implement web application firewall (WAF) rules to block XSS payloads in group name parameters
🔍 How to Verify
Check if Vulnerable:
Check admin plugin version in Grav admin dashboard or via command line: php bin/gpm version adminCheck Version:
php bin/gpm version adminVerify Fix Applied:
Verify admin plugin version is 1.11.0-beta.1 or later and test XSS payload injection in group names📡 Detection & Monitoring
Log Indicators:
- Unusual group name modifications containing script tags or JavaScript code
- Multiple failed attempts to modify group names with special characters
Network Indicators:
- POST requests to /admin/accounts/groups/ with script tags in parameters
- Unusual traffic patterns to admin interface
SIEM Query:
source="grav_logs" AND (uri_path="/admin/accounts/groups/" AND (param="data[readableName]" CONTAINS "<script>" OR param="data[readableName]" CONTAINS "javascript:"))