Leonkaya

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions prior to 1.0.8 **Description** The plugin fails to properly authorize API key generation and revocation. It intercepts the `apiKeyGenerate` and `apiKeyRevoke` admin tasks before the account-management Access Control List (ACL) runs, authorizing the caller based only on the `admin.login` permission, which is the baseline permission for every panel user. This allows any user with `admin.login` to create a persistent API key bound to any account. The forged key inherits the API permissions of the target account, potentially leading to account impersonation and privilege escalation up to full account takeover if the target account has broader permissions. **Recommendations** Update grav-plugin-api to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Grav versions 2.0.4 through 2.0.6 **Description** Remote code execution is possible through the `Blueprint::dynamicData()` function in the `system/src/Grav/Common/Data/Blueprint.php` file. The issue occurs because a `Class::method` callable string and its arguments are passed directly to `call user func array()` without an allowlist. An authenticated user with `admin.pages` or `api.pages.write` permissions can insert a malicious callable directive into a page via the form plugin. This command then executes as the web-server user when any user, including unauthenticated visitors, accesses the affected page. **Recommendations** Update Grav to version 2.0.7.