GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-65mj-f7p4-wggqmedium6.2

Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Impact

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the _Grav_ application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

getgrav/grav Packagist
Affected rangeRecorded fix
Earlier releases before 1.8.0-beta.27Ecosystem versions1.8.0-beta.27

Version evidence: OSV · GHSA-65mj-f7p4-wggq

View original version evidence (317 explicit versions)

Original source description

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter.

Details

Vulnerable Endpoint: GET /admin/pages/[page]
Parameter: data[header][content][items]

The application fails to properly validate and sanitize user input in the data[header][content][items] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.

PoC

Payload:

"><ImG sRc=x OnErRoR=alert('XSS-PoC3')>

  1. Log in to the Grav Admin Panel and navigate to Pages.

  2. Create a new page or edit an existing one.

  3. In the Advanced > Blog Config > Items field (which maps to data[header][content][items]), insert the payload above.

image

  1. Save the page.

  2. The malicious payload is reflected and rendered by the application without proper sanitization. The JavaScript code is immediately executed in the browser.

image

Impact

Reflected cross-site scripting (XSS) attacks can have serious consequences, including:

  • User actions: Attackers can perform actions on behalf of the user

  • Data theft: Sensitive information such as session cookies can be stolen

  • Account compromise: Attackers may impersonate legitimate users

  • Malicious code execution: Arbitrary JavaScript code can run in the user’s browser

  • Website defacement or misinformation: Malicious output may be injected visually

  • User redirection: Victims may be redirected to phishing or malicious websites

by CVE-Hunters

References