CVE-2026-72832: Grav: Stored XSS via quoted-attribute bypass in detectXss

September 17, 2026

A page editor without admin.super can place an event handler after a > inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.

References

github.com/advisories/GHSA-269c-h76q-8cxw
github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892
github.com/getgrav/grav/security/advisories/GHSA-269c-h76q-8cxw
nvd.nist.gov/vuln/detail/CVE-2026-72832
www.vulncheck.com/advisories/grav-before-stored-xss-via-quoted-attribute-bypass

Code Behaviors & Features

Detect and mitigate CVE-2026-72832 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →