Stored XSS in Grav Data Manager Plugin (CVE-2026-100673)

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 contain a stored cross-site scripting (XSS) vulnerability due to improper input sanitization. The vulnerability exists within the item-detail view (admin/templates/partials/item.html.twig), where user-supplied data is rendered using the Twig 'raw' filter without adequate escaping. Furthermore, the use of striptags('<br>') is insufficient as PHP's strip_tags() function can be bypassed, allowing attackers to inject malicious HTML and JavaScript payloads. An unauthenticated attacker can submit a crafted payload via a front-end form which is subsequently saved to the 'user/data' directory. When an administrator accesses the classic admin panel to view the submitted entry, the payload executes in the context of the administrator's session and origin, potentially exposing sensitive data or allowing unauthorized actions via the administrator's credentials and CSRF tokens. This issue is resolved in Data Manager version 1.4.5.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator viewing the data, leading to full account compromise or unauthorized administrative actions. This affects any site utilizing the vulnerable versions of the Data Manager plugin in the classic Grav admin interface, whereas installations using the Grav 2.0 Admin Next interface remain secure due to proper data escaping.

Recommendation

Update the Grav Data Manager plugin to version 1.4.5 or later immediately. Given the nature of the vulnerability, review all existing data submissions in the 'user/data' directory for signs of malicious script injection, such as unexpected script tags or HTML attributes.