CVE-2026-72832
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-79
Neutralización incorrecta de la entrada durante la generación de la página web (Cross-site Scripting)
Fecha de publicación:
14/08/2026
Última modificación:
14/08/2026
Descripción
*** Pendiente de traducción *** Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `" onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.
Impacto
Puntuación base 4.0
5.10
Gravedad 4.0
MEDIA
Puntuación base 3.x
5.40
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892
- https://github.com/getgrav/grav/security/advisories/GHSA-269c-h76q-8cxw
- https://www.vulncheck.com/advisories/grav-before-stored-xss-via-quoted-attribute-bypass
- https://github.com/getgrav/grav/security/advisories/GHSA-269c-h76q-8cxw