Grav version 2.0.0 contains a cross‑site scripting flaw that is triggered when Twig string concatenation is used within page content. The validator runs before Twig processes the content, so it can not detect dynamic construction of potentially dangerous attributes or tags. After Twig renders the content, the concatenated payload becomes a valid XSS vector such as an image tag with an onerror handler, executing JavaScript in the victim’s browser.

The vulnerability affects Grav content management systems prior to version 2.0.1, specifically version 2.0.0. All installations that enable Twig content processing (twig_content.process_enabled: true) and allow page‑write API permissions are susceptible.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is below 1%, meaning exploitation is unlikely but not impossible. The flaw is not listed in CISA’s KEV catalog. An attacker who can write page content via the API can inject the vulnerable Twig expression and, if the site renders page content raw, will successfully deliver a cross‑site scripting payload to visitors. The attack requires privileges to modify page content but does not need higher-level system access.