Advisory · CVE-2026-100673
Grav Data Manager stored XSS hands attackers the admin's session
The Grav Data Manager plugin 1.0.1 through 1.4.4 renders stored data entries in the item-detail view without escaping, applying Twig's raw filter, in some cases after a striptags call that PHP's strip_tags bypasses by preserving allowed tags with attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with the administrator's privileges and CSRF token. Fixed in 1.4.5.
- Vendor
- Grav
- Product
- Grav Data Manager plugin
- Identifier / CWE
- CVE-2026-100673
CWE-79 - Action timing
- Immediate
Explain it like I’m five
The suggestion box is read aloud in the manager's office without checking the words first. A prankster's note contains instructions the office follows out loud, giving the prankster the manager's keys.
- 01Payload submitted
An unauthenticated visitor submits a front-end form whose submissions are saved to user/data with an HTML payload.
- 02Stored unescaped
The entry is stored as-is; rendering applies Twig's raw filter without escaping.
- 03Admin opens entry
An administrator opens the entry in the classic admin panel's item-detail view.
- 04Script executes
The payload runs as JavaScript in the administrator's session and origin, with their privileges and CSRF token.
What happened
The Grav Data Manager plugin 1.0.1 through 1.4.4 renders stored data entries in the item-detail view without escaping, applying Twig’s raw filter, in some cases after a striptags call that PHP’s strip_tags bypasses by preserving allowed tags with attributes (CVE-2026-100673, CVSS 8.4). An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with the administrator’s privileges and CSRF token. Fixed in Data Manager 1.4.5.
What to do
- Upgrade the Data Manager plugin to 1.4.5 or later.
- Audit stored entries in user/data for HTML or script payloads, especially recent submissions.
- Review front-end forms that write to user/data and sanitize submissions at the boundary.
- Invalidate admin sessions if stored XSS exploitation cannot be ruled out.
Management note
Stored XSS in an admin panel is a session hijack with extra steps: the attacker never touches the login page, they just wait for an admin to open a poisoned entry. Patch the plugin and treat recent anonymous form submissions as untrusted input, because that is what they are.