Every CVE Search/ Get API key

CVE-2025-66309

Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

6.2 MediumFix available

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Active

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.25%Up 0.2 points since Dec 2, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.2

Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

Record
CVE-2025-66309
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-200101 6.2

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

Record
EUVD-2025-200101
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-65mj-f7p4-wggq 6.2

Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.

Details

Vulnerable Endpoint: GET /admin/pages/[page]
Parameter: data[header][content][items]

The application fails to properly validate and sanitize user input in the data[header][content][items] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.

PoC

Payload:

"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>

  1. Log in to the Grav Admin Panel and navigate to Pages.

  2. Create a new page or edit an existing one.

  3. In the Advanced > Blog Config > Items field (which maps to data[header][content][items]), insert the payload above.

  1. Save the page.

  2. The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.

Impact

Reflected cross-site scripting (XSS) attacks can have serious consequences, including:

  • User actions: Attackers can perform actions on behalf of the user

  • Data theft: Sensitive information such as session cookies can be stolen

  • Account compromise: Attackers may impersonate legitimate users

  • Malicious code execution: Arbitrary JavaScript code can run in the user’s browser

  • Website defacement or misinformation: Malicious output may be injected visually

  • User redirection: Victims may be redirected to phishing or malicious websites

by CVE-Hunters

Record
GHSA-65mj-f7p4-wggq
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-79
Updated
2026-11-02
NVD 6.2

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

Record
CVE-2025-66309
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.2

Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.

Record
CVE-2025-66309
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-65mj-f7p4-wggq 6.2

Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.

Details

Vulnerable Endpoint: GET /admin/pages/[page]
Parameter: data[header][content][items]

The application fails to properly validate and sanitize user input in the data[header][content][items] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.

PoC

Payload:

"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>

  1. Log in to the Grav Admin Panel and navigate to Pages.

  2. Create a new page or edit an existing one.

  3. In the Advanced > Blog Config > Items field (which maps to data[header][content][items]), insert the payload above.

  1. Save the page.

  2. The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.

Impact

Reflected cross-site scripting (XSS) attacks can have serious consequences, including:

  • User actions: Attackers can perform actions on behalf of the user

  • Data theft: Sensitive information such as session cookies can be stolen

  • Account compromise: Attackers may impersonate legitimate users

  • Malicious code execution: Arbitrary JavaScript code can run in the user’s browser

  • Website defacement or misinformation: Malicious output may be injected visually

  • User redirection: Victims may be redirected to phishing or malicious websites

by CVE-Hunters

Record
GHSA-65mj-f7p4-wggq
CVSS 4.0
6.2 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
getgrav/grav
Packagist
 before 1.8.0-beta.27
1.8.0-beta.27
getgrav/grav
Packagist
 before 1.8.0-beta.27, plus listed versions
0.8.00.9.00.9.10.9.100.9.11
Show 45 moreShow less
0.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.310.9.320.9.330.9.340.9.350.9.360.9.370.9.380.9.390.9.40.9.400.9.410.9.420.9.430.9.440.9.450.9.50.9.60.9.70.9.80.9.91.0.01.0.0-rc.11.0.0-rc.2
1.8.0-beta.27

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66309 is a medium vulnerability (CVSS 6.2) in Getgrav Grav, published December 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in getgrav/grav 1.8.0-beta.27.

References

This page doesn't list everything

Left out here: 267 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open