N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66311

CVE-2025-66311: Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface.

Details

Vulnerable Endpoint: POST /admin/pages/[page]
Parameters:

data[header][metadata]
data[header][taxonomy][category]
data[header][taxonomy][tag]

The application fails to properly sanitize user input when saving page metadata or taxonomy fields via the Admin Panel. As a result, an attacker with access to the admin interface can inject a malicious script using these parameters, and the script will be stored in the page's YAML frontmatter. When the page or metadata is rendered (especially in the Admin Panel), the payload is executed in the browser of any user with access.

PoC

Payload:

<script>alert('PoC-XXS51')</script>

Steps to Reproduce:

Log into the Grav Admin Panel and navigate to Pages.
Create or edit a page.
Inject the payload above into any of the following fields in the Options tab:
- Metadata key name
- Category under Taxonomy
- under Taxonomy

Miggo Vulnerability Database

→

CVE-2025-66311

CVE-2025-66311:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
getgrav/grav	composer	< 1.11.0-beta.1	1.11.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the Grav admin panel. An attacker can inject malicious scripts into page taxonomy fields (like tags or categories) or metadata. These scripts are saved to the page's frontmatter and are executed when the page is viewed or edited in the admin panel, as the injected values are rendered without proper HTML escaping.

The provided patch 99f653296504f1d6408510dd2f6f20a45a26f9b0 addresses this by fixing the rendering of these values on the client side.

The core of the fix is in themes/grav/app/forms/fields/selectize.js. The selectize component is used for taxonomy fields. Before the patch, the component was initialized without a secure renderer, meaning that any HTML in the taxonomy tags would be rendered as-is by the browser.

The patch introduces default render functions (SafeRender.option and SafeRender.item) that use an escape function to neutralize any HTML in the item's text or value. These safe renderers are now applied by default to all selectize fields within the SelectizeField constructor.

The vulnerable function is therefore the constructor of the SelectizeField class, which was responsible for the insecure initialization of the component. A runtime profile during exploitation would show this constructor being called to create the vulnerable dropdown field, which then renders the malicious script.

The patch also includes a change in themes/grav/templates/forms/fields/taxonomy/taxonomy.html.twig to escape the taxonomy field's label, providing another layer of protection. However, the primary vector for the described vulnerability (injecting malicious tags) is addressed by the selectize.js modification.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.