{"apiVersion":"1.0","identifier":"CVE-2026-72832","description":"Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and uses `[^>]*?`, which cannot cross the first literal `>`; when a `>` appears inside a quoted attribute value the browser keeps the tag open and parses a subsequent event handler (e.g. onerror), so the detector and browser disagree. A page editor without admin.super privileges can save page content such as `<img src=x title=->- onerror=alert(document.domain)>`, which is accepted, stored, and executed in the site origin when any visitor (including unauthenticated users) views the page. Fixed in 2.0.13.","publishedAt":"2026-08-14T12:16:46","lastModifiedAt":"2026-08-14T15:17:10","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72832","cvssScore":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","epssProbability":0.0018,"riskScore":0.55,"affectedProduct":"Grav","affectedVersions":">=1.5.2,<=2.0.12","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72832","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72832","en":"https://www.redsauce.net/en/cves/CVE-2026-72832","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72832","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72832","de":"https://www.redsauce.net/de/cves/CVE-2026-72832","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72832","el":"https://www.redsauce.net/el/cves/CVE-2026-72832"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72832"}}