CVE-2026-44737 Grav: Stored XSS via page title (data[header][title]) in admin panel
Attackers can inject malicious scripts via the page title parameter, leading to script execution in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44737?
CVE-2026-44737 is a medium-severity cross-site scripting vulnerability in getgrav grav-plugin-admin, published on 11 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session. This vulnerability is fixed in 1.10.49.5.
Weakness: CWE-79
Which versions are affected by CVE-2026-44737?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 1.7.49.5 |
getgrav/grav Packagist | All versions | 1.7.49.5 |
How do I fix CVE-2026-44737?
Upgrade getgrav/grav to 1.7.49.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-44737 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44737 exists.
Sources
Also known as GHSA-fmg2-f5r9-24qc.