Grav CMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Grav CMS version 1.7.49.5. This issue allows remote attackers to inject arbitrary JavaScript, leading to stored XSS. The vulnerability arises because user input is returned without proper sanitization, enabling attackers to execute scripts in the context of the administrator's session.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, upload a parameter that includes JavaScript. The injected script will be executed when the page is accessed, demonstrating the cross-site scripting flaw.