CVE-2025-66308: getgrav grav Cross-site Scripting

Vulnerability summary

CVE-2025-66308 is a medium (CVSS 6.8) Cross-site Scripting vulnerability in getgrav grav. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-12-2025
   PublishedVulnerability first disclosed.
2. 02-12-2025
   Last modifiedVulnerability information updated.

Description

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.