Grav stored XSS via assets sandbox allowlist (editor→super-admin)

TL;DR

The Twig sandbox shipped by Grav 2.0.x allowed assets.addJs/assets.addCss calls from untrusted page content. A user with page-edit rights could persist a <script> that runs in the admin context, taking over super-admin on next view. Fixed in 2.0.20.

Target & scope

Affected: Grav 2.0.0–2.0.19 (default configuration)
Fixed: 2.0.20 (assets API restricted in sandbox)

Root cause

The Twig sandbox allowlist included assets.addJs/assets.addCss, enabling script injection via page front-matter or body processed through Twig, which executes in the admin preview and some theme contexts.

Exploitation

evidence — Sanitized PoC (editor role)

Title: X
Body (Markdown with Twig):
{% do assets.addJs('inline', 'window.GRAV_POC=1; fetch("/admin")') %}

Open the page in admin or a theme rendering with Twig enabled → JS executes.

Observation: window.GRAV_POC === 1

Remediation

Upgrade to 2.0.20 or later. Ensure the Twig sandbox does not expose mutating asset APIs to untrusted content. Consider disabling Twig processing for untrusted fields.

Disclosure timeline

date (UTC)	event
2026-08-30	found
2026-08-31	reported to vendor
2026-09-03	acknowledged
2026-09-05	fixed (2.0.20)
2026-09-05	NVD published