CVE-2025-66311
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The admin plugin for Grav (an HTML user interface for configuring Grav and editing pages) contains a Stored Cross-Site Scripting (XSS) vulnerability in the /admin/pages/[page] endpoint. Attackers can inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters, which are stored in the page frontmatter and executed whenever the page is accessed or rendered in the administrative interface. The vulnerability is fixed in version 1.11.0-beta.1.
Risk Assessment
An authenticated attacker can persistently inject malicious JavaScript that executes in an administrator's browser, enabling session theft or takeover of a privileged account. This can lead to full compromise of the Grav administrative panel.
Recommendation
Update the Grav admin plugin to version 1.11.0-beta.1 or later. Until patched, restrict access to the administrative panel and validate user-supplied content.
Other vulnerabilities in Grav admin plugin
Original NVD description (English source)
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters. These scripts are stored in the page frontmatter and executed automatically whenever the affected page is accessed or rendered in the administrative interface. This vulnerability is fixed in 1.11.0-beta.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS