Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...