What is CVE-2026-75834?
CVE-2026-75834 is a stored XSS vulnerability in Grav CMS before version 2.0.14, located in the Security::detectXss() function. The flaw occurs because all XSS detection patterns use the PCRE /u (UTF-8) modifier, causing preg_match() to return false upon encountering any invalid UTF-8 byte in page content, thus bypassing the security check. Users should upgrade to Grav 2.0.14 or later immediately.
Azərbaycanca: CVE-2026-75834, Grav CMS-in 2.0.14-dən əvvəlki versiyalarında Security::detectXss() funksiyasında aşkarlanmış stored XSS zəifliyidir. Bu zəiflik XSS aşkarlama pattern-lərinin yalnız PCRE /u (UTF-8) modifikatoru ilə işləməsi səbəbindən yaranır; səhifə məzmununda hər hansı bir qeyri-valid UTF-8 baytı `preg_match()`-in `false` qaytarmasına gətirib çıxararaq təhlükəsizlik yoxlamasını yan keçir. Grav istifadəçiləri dərhal 2.0.14 versiyasına yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-79; shared vendor: Grav
FAQ2
Which versions of Grav CMS are affected by CVE-2026-75834?
This vulnerability affects Grav CMS versions before 2.0.14.
How is the XSS check bypassed in CVE-2026-75834?
When page content contains an invalid UTF-8 byte, preg_match() with the /u modifier returns false, causing the Security::detectXss() function's security check to be bypassed.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.