CVE-2026-44737: Grav: Stored XSS via page title (data[header][title]) in admin panel

May 8, 2026 (updated May 13, 2026)

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][title] parameter.

References

github.com/advisories/GHSA-fmg2-f5r9-24qc
github.com/getgrav/grav-plugin-admin/commit/f67cc18e81d8767bb43d29ee6422c55ed0427803
github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc
nvd.nist.gov/vuln/detail/CVE-2026-44737

Code Behaviors & Features

Detect and mitigate CVE-2026-44737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →