CVE-2026-72832

Name of the Vulnerable Software and Affected Versions Grav versions 1.5.2 through 2.0.12

Description A stored cross-site scripting issue exists in the Security::detectXss() function located in system/src/Grav/Common/Security.php. The event-handler scan uses a regular expression that fails to account for the > character when it appears inside a quoted attribute value. This discrepancy between the detector and the browser allows a page editor without admin.super privileges to save malicious content, such as <img src=x title=">" onerror=alert(document.domain)>. The payload is stored and subsequently executed in the site origin when viewed by any visitor, including unauthenticated users.

Recommendations Update to version 2.0.13.