CVE-2026-100673 getgrav CVE debrief

Who should care

Administrators and users of the Grav Data Manager plugin, particularly those using versions 1.0.1 through 1.4.4, should assess their exposure and take steps to mitigate the vulnerability.

Why it matters

The Grav Data Manager plugin versions 1.0.1 through 1.4.4 are vulnerable to stored XSS via the item-detail view. This vulnerability allows an unauthenticated visitor to store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, potentially leading to unauthorized actions with the administrator's privileges.

• An unauthenticated visitor can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel
• Execution occurs without further interaction for list values and on hover for ordinary text fields
• The issue is fixed in Data Manager 1.4.5

Technical summary

The Grav Data Manager plugin versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view without escaping, applying Twig's `raw` filter — in some cases after a striptags('<br>') call that PHP's strip_tags() bypasses by preserving allowed tags together with their attributes. This allows an unauthenticated visitor to store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, potentially leading to unauthorized actions with the administrator's privileges.

Defensive priority

High

Recommended defensive actions

• Upgrade to Data Manager 1.4.5 or later
• Review and sanitize user-input data
• Implement additional security measures to prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score of 8.4. However, there is no record of exploitation. The vulnerability affects Grav Data Manager plugin versions 1.0.1 through 1.4.4. The issue is fixed in Data Manager 1.4.5. Defenders should verify affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.