CVE-2026-75834 getgrav CVE debrief

Who should care

System administrators and security teams responsible for Grav installations, especially those allowing page edits, should assess exposure and prioritize updating to version 2.0.14 or later.

Why it matters

CVE-2026-75834 is a stored cross-site scripting vulnerability in Grav before 2.0.14. An authenticated attacker with page-edit permissions can store malicious JavaScript that executes in the browser of a visitor who views the affected page. This vulnerability has a CVSS score of 5.1 and is considered medium severity. System administrators and security teams responsible for Grav installations, especially those allowing page edits, should assess exposure and prioritize updating to version 2.0.14 or later.

• Execution of malicious JavaScript in visitors' browsers
• Potential theft of sensitive information
• Defacement of web pages or unauthorized actions

Technical summary

The vulnerability exists in the Security::detectXss() function in system/src/Grav/Common/Security.php. The XSS detection patterns use the PCRE /u (UTF-8) modifier, which causes preg_match() to return false for every pattern if a single invalid UTF-8 byte is present in page content. This allows an authenticated attacker with page-edit permissions to store malicious JavaScript that executes in the browser of a visitor who views the affected page.

Defensive priority

Medium priority for systems using Grav versions before 2.0.14, especially those allowing page edits.

Recommended defensive actions

• Update Grav to version 2.0.14 or later
• Restrict page edit permissions to trusted users
• Monitor for suspicious page content changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Security::detectXss() function in system/src/Grav/Common/Security.php. The XSS detection patterns use the PCRE /u (UTF-8) modifier, which causes preg_match() to return false for every pattern if a single invalid UTF-8 byte is present in page content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.