Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | >= 1.5.2, <= 2.0.12 | 2.0.13 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-72832, describes a Stored XSS bypass in Grav's Security::detectXss() function. The core issue was that the regular expression used by detectXss() to identify event handlers (on_events) and xmlns attributes was not 'quote-aware'. Specifically, the [^>]*? pattern would stop at the first literal > character, even if that > was part of a quoted attribute value (e.g., <img src=x title=">" onerror=alert(document.domain)>). This allowed an attacker to hide an onerror attribute after the quoted > which the browser would parse, but Grav's detectXss() would miss. A subsequent bypass was also identified where a quoted attribute value was immediately followed by an event handler without a separator (e.g., <img title="y"onerror=alert(1)>), which also evaded detection. The AdminController::savePage() function, which relies on detectXss() to validate user-submitted page content, would then store this malicious payload. When a user viewed the page, the XSS would execute. The fix involved modifying the regular expressions within Security::detectXss() to correctly handle quoted attribute values and adjacent event handlers, making the regex 'quote-aware' and preventing these bypasses. Therefore, Security::detectXss is the precise function that contained the vulnerability and would appear in a runtime profile during exploitation.
Grav\Common\Security::detectXsssystem/src/Grav/Common/Security.php