CVE-2025-66310: Cross-Site Scripting (XSS) Stored endpoint /admin/pages/[page] parameter data[header][template] in Advanced Tab
CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-66310
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.
Details
Vulnerable Endpoint: POST /admin/pages/[page]
Parameter: data[header][template]
The application fails to properly sanitize user input in the data[header][template] field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.
PoC
Payload
| |
Steps to Reproduce:
- Log in to the Grav Admin Panel and navigate to Pages.
- Create a new page or edit an existing one.
- In the Advanced > Template field (which maps to
data[header][template]), insert the payload:
- Save the page.
- Return to the Pages section and click on the three-dot menu of the affected page:
- The stored XSS payload is triggered, and the script is executed in the browser:
Impact
- Session hijacking: Stealing cookies or authentication tokens to impersonate users.
- Credential theft: Harvesting usernames and passwords using malicious scripts.
- Malware delivery: Distributing unwanted or harmful code to victims.
- Privilege escalation: Compromising administrative users through persistent scripts.
- Data manipulation or defacement: Changing or disrupting site content.
- Reputation damage: Eroding trust among site users and administrators.
Reference
https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj
Finder
By: CVE-Hunters