CVE-2026-75834: Grav Package Vulnerability Allows XSS Bypass via Invalid UTF-8 Input
Summary
CVE-2026-75834: Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss() (all six entries in the $patterns array use the PCRE u modifier), invoked from Grav\Common\Data\Validatio... Affects getgrav/grav versions < 2.0.14. Fixed in 2.0.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grav is a modern open-source flat-file content management system (CMS) that allows users to create and manage websites without the need for a traditional database. It is designed for speed and simplicity, utilizing a file-based architecture that enables easy deployment and management of content. However, Grav has a vulnerability in its security detection mechanism that can lead to cross-site scripting (XSS) attacks when invalid UTF-8 bytes are present in user input.
Vulnerability Detail
The vulnerability arises from the detectXss() function in the Grav core, specifically in the Security.php file. This function uses regular expressions with the PCRE u modifier to detect XSS patterns. When the input contains even a single invalid UTF-8 byte, the preg_match() function fails and returns false for all checks, allowing potentially malicious content to bypass the XSS safety gate. This can lead to stored XSS attacks, where an attacker can inject JavaScript code that executes in the browser of any visitor, including administrators.
How To Fix
Minimum fixed version
2.0.14
This is the first release that contains the fix.
composer require getgrav/grav:2.0.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate user input to ensure it is valid UTF-8 before it reaches the detectXss() function. This can be done using the mb_check_encoding() function in PHP, which checks if the string is valid UTF-8. If the input is invalid, you can reject it or sanitize it before processing.
Conclusion
CVE-2026-75834 presents a significant security risk for Grav users, allowing XSS attacks through invalid UTF-8 input. It is crucial to update to the latest version of Grav to mitigate this vulnerability. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for getgrav/grav →
FAQ
CVE-2026-75834 is a vulnerability in the Grav CMS that allows attackers to bypass XSS protections by using invalid UTF-8 bytes in user input.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
The main risk is stored XSS, where an attacker can inject malicious JavaScript that executes in the browsers of users visiting the affected page, potentially compromising their sessions.
To update your Grav installation, run the command composer update getgrav/grav in your terminal. Ensure you are using version 2.0.14 or later to mitigate the vulnerability.
If you cannot update immediately, implement input validation using mb_check_encoding() to ensure all user input is valid UTF-8 before processing it.
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
