EUVD-2026-44650

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation...

Cross Site Scripting

Grav is vulnerable to Cross Site Scripting. The vulnerability is due to the XSS blueprint validator running on raw page content before Twig processing, where an attacker with page-write API permission can use Twig's string concatenation operator to dynamically construct event handler names, and...

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

PT-2026-60147

Name of the Vulnerable Software and Affected Versions Grav version 2.0.0 Description An issue exists where the XSS blueprint validator Security::detectXss processes raw page content before Twig processing occurs. If Twig content processing is enabled via twig content.process enabled: true, a user...

CVE-2026-61453: Improper Neutralization of Input During Web Page Generation

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...