Grav CMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Grav CMS version 1.7.49. The issue arises in the page editor, where authenticated users can modify content using a Markdown editor. The editor does not adequately sanitize <script> tags, which enables the execution of stored XSS payloads when the pages are accessed through the admin interface.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.