CVE-2026-75834

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14

Description A stored cross-site scripting issue exists in the Security::detectXss() function located in system/src/Grav/Common/Security.php. The XSS detection patterns utilize the PCRE /u (UTF-8) modifier, which causes preg match() to return false for all patterns if a single invalid UTF-8 byte is present in the page content. This behavior allows the save-time XSS safety gate Validation::checkSafety() to be bypassed. An authenticated attacker with page-edit permissions, who lacks the security.xss whitelist privilege, can store malicious JavaScript that executes in the browser of any visitor viewing the affected page.

Recommendations Update to version 2.0.14 or later.