CVE-2026-72832 getgrav CVE debrief

Who should care

Site administrators and users with page editor privileges in Grav versions from 1.5.2 through 2.0.12 should assess exposure and prioritize patching. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-72832 is a stored cross-site scripting vulnerability in Grav that allows an attacker to execute malicious JavaScript code in the context of other users. Site administrators and users with page editor privileges should assess exposure and prioritize patching.

• An attacker can execute arbitrary JavaScript code in the context of other users
• An attacker can steal user sessions or sensitive information
• An attacker can deface or modify site content

Technical summary

The Security::detectXss() function in Grav versions from 1.5.2 through 2.0.12 is vulnerable to stored cross-site scripting. The function is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`. This allows an attacker to save malicious page content that is executed when visited by other users. The vulnerability is caused by the event-handler scan being anchored at `<` and using `[^>]*?`, which cannot cross the first literal `>`. This allows an attacker to save page content such as `<img src=x title=></img>onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor views the page.

Defensive priority

Medium priority for patching and verification

Recommended defensive actions

• Patch Grav to version 2.0.13 or later
• Verify that all user-supplied input is properly sanitized
• Monitor for suspicious activity on the site
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the event-handler scan being anchored at `<` and using `[^>]*?`, which cannot cross the first literal `>`. This allows an attacker to save page content such as `<img src=x title=></img>onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor views the page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.