CVE-2025-66310

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][template] parameter. The script is saved within the page's frontmatter and executed automatically whenever the affected content is rendered in the administrative interface or frontend view.

Details

Vulnerable Endpoint: POST /admin/pages/[page]
Parameter: data[header][template]

The application fails to properly sanitize user input in the data[header][template] field, which is stored in the YAML frontmatter of the page. An attacker can inject JavaScript code using this field, and the payload is rendered and executed when the page is accessed, especially within the Admin Panel interface.

PoC

Payload:

<script>alert('PoC-XXS73')</script>

Steps to Reproduce:

1. Log in to the Grav Admin Panel and navigate to Pages.

2. Create a new page or edit an existing one.

3. In the Advanced > Template field (which maps to data[header][template]), insert the payload:
   

4. Save the page.

5. Return to the Pages section and click on the three-dot menu of the affected page:
   

6. The stored XSS payload is triggered, and the script is executed in the browser:
   

Stored XSS vulnerabilities can have serious consequences, including:

• Session hijacking: Capturing admin session cookies or tokens

• Malware delivery: Executing scripts that load malicious resources

• Credential theft: Creating fake login prompts to steal usernames/passwords

• Data exposure: Reading sensitive metadata or page contents

• Privilege escalation: Performing actions as an authenticated user

• Website defacement: Altering visual or functional elements of the site

• Reputation damage: Undermining user trust in the application

by CVE-Hunters

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Kodem intelligence

1. What is CVE-2025-66310? CVE-2025-66310 is a medium-severity cross-site scripting (XSS) vulnerability in getgrav/grav (composer), affecting versions < 1.8.0-beta.27. It is fixed in 1.8.0-beta.27. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. Which versions of getgrav/grav are affected by CVE-2025-66310? getgrav/grav (composer) versions < 1.8.0-beta.27 is affected.
3. Is there a fix for CVE-2025-66310? Yes. CVE-2025-66310 is fixed in 1.8.0-beta.27. Upgrade to this version or later.
4. Is CVE-2025-66310 exploitable, and should I be worried? Whether CVE-2025-66310 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-66310 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-66310? Upgrade getgrav/grav to 1.8.0-beta.27 or later.