CVE-2026-75828: getgrav/grav (Composer (PHP))

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
EPSS 0.4%, percentile 32: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 32% of all scored CVEs (low). EPSS is a probability, not a verdict.
Needs an account (low (any account)). Exposure depends on who can log in.
Only applies if your dependency tree includes getgrav/grav (Composer (PHP)) <= 2.0.14, fixed in 2.0.15. Check your lockfile, including transitive dependencies.

What it is

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

From the GitHub advisory

Affected versions and vulnerable location

- Confirmed on grav core at 78ebfc1 (tag 2.0.13). - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches() (:315-330). - The onevents pattern at HEAD: # "'])?(?:[\s\x00-\x20"'/]|"[^"]"|'[^']')on\s[a-z]+\s=#iu - Sole save-time guard for non-super content: Validation::checkSafety() (system/src/Grav/Common/Data/Validation.php:160 scalars, :165 arrays), invoked per field from BlueprintSchema::validate -> Validation::checkSafety (system/src/Grav/Common/Data/BlueprintSchema.php:248). security.xsswhitelist: [admin.super] exempts only super-admins (Validation.php:148).

Root cause (distinct from GHSA-269c)

GHSA-269c hardened the tag-body scan to be quote-aware so a > inside a paired quoted attribute value is treated as data, not a tag close. That same quote-awareness opened a new gap: the regex treats ANY " or ' as a string delimiter, but HTML only enters a quoted-value state when a quote appears immediately after =. A single unpaired quote sitting inside an unquoted attribute value is, to the browser, just a value character; to the regex it is an unterminated string that neither [^>"'] nor "[^"]" can consume, so the lazy tag-body scan cannot advance past it to reach the following on...= handler. No alignment matches and detectXss() returns null.

Proof (executed)

Weakness type: CWE-79.

Product: getgrav/grav (Composer (PHP)) · Assigned by: VulnCheck · Published: 2026-08-18

Affected and fixed versions

Ecosystem	Package	Vulnerable	First fixed
Composer (PHP)	`getgrav/grav`	<= 2.0.14	2.0.15

Vendor	Product	Affected versions (per CVE record)
getgrav	grav	< 2.0.15

Severity scores

Scored by	CVSS	Score	Vector
VulnCheck	4.0	9.3 Critical	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`
VulnCheck	3.1	8.7 High	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`
GitHub	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N`

Attack vector: network (remotely reachable)
Attack complexity: low
Attack requirements: none
Privileges required: low (any account)
User interaction: passive

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 0.39% probability of exploitation activity in the next 30 days; percentile 32.

Timeline

2026-08-18 — CVE record published by VulnCheck
2026-09-17 — GitHub-reviewed advisory GHSA-vfmf-q6x9-cw96 published (critical)
2026-10-08 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.