Grav CMS was found to allow an authenticated attacker with page‑edit permissions, lacking the security.xss_whitelist privilege, to store malicious JavaScript in page content. The flaw lies in the Security::detectXss() function, where all XSS detection patterns use the PCRE /u modifier. A single invalid UTF‑8 byte anywhere in the content causes preg_match() to return false for every pattern, silently bypassing the safety gate at save time. When a visitor views the affected page, the stored payload executes in the browser, enabling actions such as session hijacking, defacement, or the propagation of additional malware.

The vulnerable product is Grav CMS (vendor getgrav:grav). Versions prior to 2.0.14 are affected. No additional version specifics are provided in the advisory.

The CVSS score of 5.1 classifies the vulnerability as medium severity. EPSS information is not available, and it is not listed in the CISA KEV catalog, suggesting no widespread known exploitation. However, because the attack requires authentication with page‑edit rights, the risk is limited to users who have such permissions. The bypass occurs at the save time, so an attacker must be able to create or edit a page and then wait for a visitor to load the page for the payload to execute.