CVE-2025-66843
📋 TL;DR
Grav CMS versions before 1.7.49.5 contain a stored cross-site scripting vulnerability in page editing functionality. Authenticated users with content editing permissions can inject malicious JavaScript that executes when other users view or edit affected pages. This affects all Grav installations with user accounts that have edit permissions.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
An attacker could steal administrator session cookies, perform actions as other users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers with low-privileged accounts could steal session tokens from administrators or other users, potentially escalating privileges.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated access with edit permissions. Public proof-of-concept demonstrates basic XSS payload injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.49.5
Vendor Advisory: https://github.com/getgrav/grav/releases/tag/1.7.49.5
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update Grav core via GPM: 'bin/gpm selfupgrade'. 3. Update plugins: 'bin/gpm update'. 4. Clear cache: 'bin/grav clear-cache'.
🔧 Temporary Workarounds
Input Validation Filter
allImplement custom input validation to sanitize HTML content in page editing fields
Implement custom validation in user/plugins/admin/blueprints.yaml or custom plugin
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact
Add 'Content-Security-Policy' header with script-src directives
🧯 If You Can't Patch
- Restrict page editing permissions to trusted administrators only
- Implement web application firewall rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check Grav version in system.yaml or via CLI: 'bin/grav version'Check Version:
bin/grav versionVerify Fix Applied:
Confirm version is 1.7.49.5 or later and test page editing with XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual content edits containing script tags or JavaScript
- Multiple failed login attempts followed by content edits
Network Indicators:
- Unexpected outbound connections from admin interface
- Suspicious POST requests to page editing endpoints
SIEM Query:
source="grav-logs" AND ("script" OR "javascript" OR "onclick" OR "onload") AND event="page_edit"