{"id":"CVE-2025-66308","aliases":["GHSA-gqxx-248x-g29f"],"url":"https://o3.security/vulnerability/CVE-2025-66308","summary":"Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`","details":"## Summary\n\nA Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/config/site` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[taxonomies]` parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector.\n\n---\n\n## Details\n\n**Vulnerable Endpoint:** `POST /admin/config/site`  \n**Parameter:** `data[taxonomies]`\n\nThe application does not properly validate or sanitize input in the `data[taxonomies]` field. As a result, an attacker can inject JavaScript code, which is stored in the site configuration and later rendered in the administrative interface or site output, causing automatic execution in the user's browser.\n\n---\n\n## PoC\n\n**Payload:**\n\n`\"><script>alert('XSS-PoC')</script>`\n\n### Steps to Reproduce:\n\n1. Log in to the _Grav_ Admin Panel with sufficient permissions to modify site configuration.\n    \n2. Navigate to **Configuration > Site**.\n    \n3. In the **Taxonomies Types** field (which maps to `data[taxonomies]`), insert the payload above:\n          \n    `\"><script>alert('XSS-PoC')</script>`\n    \n4. Save the configuration.\n\n<img width=\"1897\" height=\"628\" alt=\"Pasted image 20250718195942\" src=\"https://github.com/user-attachments/assets/2035fcaa-34fc-494c-a7ca-7c1e1f34b057\" />\n    \n5. Go on Pages and click on one of them\n\n<img width=\"932\" height=\"587\" alt=\"Pasted image 20250718200306\" src=\"https://github.com/user-attachments/assets/3c1995ba-2581-4e27-ae9d-a17e2eeb5b57\" />\n    \n6. The stored payload is executed immediately in the browser, confirming the Stored XSS vulnerability.\n\n<img width=\"1204\" height=\"377\" alt=\"Pasted image 20250718200353\" src=\"https://github.com/user-attachments/assets/ad8ea7ea-603f-4b84-aa5a-120de0cb56ce\" />\n    \n7. The HTTP request submitted during this process contains the vulnerable parameter and payload:\n    \n<img width=\"757\" height=\"675\" alt=\"Pasted image 20250718200445\" src=\"https://github.com/user-attachments/assets/fbbe2b76-00eb-4426-8ddd-5cde2cc65d77\" />\n\n---\n\n## Impact\n\nStored XSS attacks can lead to severe consequences, including:\n\n- **Session hijacking:** Stealing cookies or authentication tokens to impersonate users\n    \n- **Credential theft:** Harvesting usernames and passwords using malicious scripts\n    \n- **Malware delivery:** Distributing unwanted or harmful code to victims\n    \n- **Privilege escalation:** Compromising administrative users through persistent scripts\n    \n- **Data manipulation or defacement:** Changing or disrupting site content\n    \n- **Reputation damage:** Eroding trust among site users and administrators\n    \n\n---\n\n## Discoverer\n\n[Marcelo Queiroz](www.linkedin.com/in/marceloqueirozjr) \n\nby [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)","published":"2025-12-01T22:00:42.343Z","modified":"2026-08-12T03:51:45.514697302Z","cvss":null,"epss":{"score":0.00214,"percentile":0.1187,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"getgrav/grav","fixedVersion":"1.8.0-beta.27"}],"fix":{"url":"https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0","label":"getgrav/grav-plugin-admin@99f6532"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66308.json"},{"type":"ADVISORY","url":"https://github.com/getgrav/grav/security/advisories/GHSA-gqxx-248x-g29f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66308"},{"type":"FIX","url":"https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0"},{"type":"PACKAGE","url":"https://github.com/getgrav/grav"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:45.514697302Z"}}