# CVE-2025-66310: grav XSS — Fix Available 🐘 Packagist Not in CISA KEV # CVE-2025-66310 — grav [Fix: getgrav/grav-plugin-admin@99f6532](https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0) CVE-2025-66310 is a Cross-site Scripting (XSS) vulnerability in getgrav/grav. A fix is available for getgrav/grav — see the affected versions and patch details below. Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint \`/admin/pages/\[page\]\` parameter \`data\[header\]\[template\]\` in Advanced Tab Also known as[GHSA-7g78-5g5g-mvfj](/vulnerability/GHSA-7g78-5g5g-mvfj) Published Dec 1, 2025 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-66310. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs14th percentile — riskier than 14% of all scored CVEsHighest risk 0.00%0.24%0.49%0.73%0.0%0.2%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 1 pkg affected 🐘`getgrav/grav` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description ### Summary A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `/admin/pages/[page]` endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the `data[header][template]` parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. * * * ### Details **Vulnerable Endpoint:** `POST /admin/pages/[page]` **Parameter:** `data[header][template]` The application fails to properly sanitize user input in the `data[header][template]` field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface. * * * ### PoC **Payload:** `` #### Steps to Reproduce: 1. Log in to the _Grav_ Admin Panel and navigate to **Pages**. 2. Create a new page or edit an existing one. 3. In the **Advanced > Template** field (which maps to `data[header][template]`), insert the payload: ![image](https://github.com/user-attachments/assets/fc92aa09-e363-4422-b577-63aa27097886) 4. Save the page. 5. Return to the **Pages** section and click on the **three-dot menu** of the affected page: ![image](https://github.com/user-attachments/assets/ea6a023b-f838-4700-b2a8-8dcfbca37f00) 6. The stored XSS payload is triggered, and the script is executed in the browser: ![image](https://github.com/user-attachments/assets/8cf1cca5-ce8f-4b09-a57c-0848090918ac) * * * ### Impact Stored XSS vulnerabilities can have serious consequences, including: - **Session hijacking:** Capturing admin session cookies or tokens - **Malware delivery:** Executing scripts that load malicious resources - **Credential theft:** Creating fake login prompts to steal usernames/passwords - **Data exposure:** Reading sensitive metadata or page contents - **Privilege escalation:** Performing actions as an authenticated user - **Website defacement:** Altering visual or functional elements of the site - **Reputation damage:** Undermining user trust in the application by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters) ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `getgrav/grav` all versions 1.8.0-beta.27`composer require getgrav/grav:^1.8.0-beta.27` ## Affected Products 1 product · 1 configurations Application `grav-plugin-admin`getgrav ≤ 1.10.50 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getgrav/grav, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update getgrav/grav to 1.8.0-beta.27 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-66310 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions \## Summary A Stored Cross-Site Scripting (XSS) vulnerability was identified in the \`/admin/pages/\[page\]\` endpoint of the \_Grav\_ application. This vulnerability allows attackers to inject malicious scripts into the \`data\[header\]\[template\]\` parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view. --- ## Details \*\*Vulnerable Endpoint:\*\* \`POST /admin/pages/\[page\]\` \*\*Parameter:\*\* \`data\[header\]\[template\]\` The application fails to properly sanitize user input in the \`data\[ O3 Security · Impact-Aware SCA ### Is CVE-2025-66310 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)