CVE-2026-100673

Executive Summary

CVE-2026-100673 is a stored cross-site scripting (XSS) vulnerability in the Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4. The flaw allows an unauthenticated visitor to submit a front-end form that stores an HTML/JavaScript payload in user-generated data; when an administrator later opens that entry in the classic admin panel, the payload executes in the administrator's session and origin. Successful exploitation can lead to administrative account compromise, session/CSRF token theft, and full site takeover, as reflected by the CVSS base score of 8.2.

Technical Analysis

The vulnerability resides in the plugin's item-detail rendering path. According to the NVD description, stored data entries are rendered in admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter. In some cases the unescaped output follows a striptags('<br>') call — but PHP's strip_tags() preserves the allowed tag together with its attributes, so attribute-based JavaScript injection (for example via event-handler attributes on a permitted tag) survives the sanitization step. Because the template trusts this filtered content and emits it with raw, the browser parses and executes attacker-controlled markup in the admin origin.

The attack surface is the front-end form ingestion path. A public visitor submits a form whose submissions are persisted to user/data. No authentication is required to plant the payload (PR:N). Execution requires that an administrator subsequently views the affected entry in the classic admin panel (UI:R). The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N is consistent with this model: network-reachable, low complexity, no privileges, user interaction needed, and a scope change (S:C) because the script executes in the privileged admin context rather than the anonymous submitter's context.

Two execution behaviors are important for triage. For list values such as checkbox or multi-select fields, the payload executes without further interaction as soon as the entry is rendered. For ordinary text fields, execution triggers on hover. Both paths require the administrator to open the record in the classic admin interface.

Sites running the Grav 2.0 Admin Next interface are explicitly not affected, because that interface renders the same data through a separate, correctly escaping code path. This version/interface distinction is critical for asset inventory and for scoping exposure. The issue is stated to be fixed in Data Manager 1.4.5.

No public PoC, exploit code, or Nuclei template is available, and there is no CISA KEV listing. The mechanism above is derived strictly from the NVD description; no implementation specifics beyond those documented are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level (stored XSS via unescaped template rendering) from the NVD description.

1. Reconnaissance/target identification: An attacker identifies a Grav site using the Data Manager plugin with a front-end form whose submissions are stored to user/data, and where the classic (non-Admin Next) admin panel is in use. The classic interface is the necessary condition for execution.

2. Triggering the flaw: The attacker submits a crafted front-end form entry containing an HTML payload. Because the stored value is later rendered with Twig's raw filter — in some cases after a striptags('<br>') step that fails to strip attributes from allowed tags — the markup is stored intact in user/data. No authentication is needed to store the payload.

3. Payload/execution method: When an administrator opens that entry in the classic admin panel, the stored markup is parsed by the browser. For list-type fields (checkbox or multi-select), the payload executes immediately on render; for ordinary text fields, it executes on hover. The script runs with the administrator's privileges and has access to that session's CSRF token.

4. Post-exploitation impact: With code executing in the admin origin and session, an attacker can perform authenticated administrative actions, exfiltrate data, or persist access — effectively achieving site takeover. The scope change (S:C) and high confidentiality impact (C:H) reflect that the script acts in the privileged session rather than the submitter's.

Impact Assessment

Business impact centers on administrative compromise of a public-facing CMS. Because the payload executes in the admin session and origin, an attacker can act as the administrator, including using the victim's CSRF token to perform privileged operations. This elevates a low-privilege, unauthenticated form submission into full site control.

Affected systems are Grav deployments running the Data Manager plugin versions 1.0.1 through 1.4.4 with a front-end form persisting submissions to user/data, viewed through the classic admin panel. Grav 2.0 Admin Next deployments are not affected, which meaningfully narrows the blast radius. Blast radius within an affected site includes all data and functionality governed by the administrator account, plus any admin-accessible integrations or content.

CVSS subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:N (no authentication to store the payload), UI:R (admin must open the entry), S:C (impact crosses from unprivileged submitter context into privileged admin context), C:H (full data exposure within the admin session), I:L (limited integrity impact as scored), A:N (no availability impact). The overall base score is 8.2.

Detection Guidance

Detection should focus on stored XSS payloads in Grav Data Manager submissions and on suspicious admin-panel rendering activity. The following rules are detection engineering templates; tune field mappings, indexes, and severity to your environment.

Sigma Rule

title: Grav Data Manager Stored XSS Payload Submission (CVE-2026-100673)
id: 8f3c1a2e-4b7d-4e6a-9c1f-2a5b6d7e8f90
status: experimental
description: Detects HTML/JavaScript payloads submitted to Grav Data Manager front-end forms that may be stored and executed in the classic admin panel.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100673
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    http.method: 'POST'
  selection_payload:
    - http.request.body|contains:
        - '<script'
        - 'onmouseover='
        - 'onerror='
        - 'onload='
        - 'javascript:'
        - '<img'
        - '<svg'
        - '<iframe'
  selection_path:
    http.url|contains:
      - '/datamanager'
      - 'user/data'
  condition: selection_method and selection_payload and selection_path
fields:
  - c-ip
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate rich-text form submissions containing markup
level: high
tags:
  - attack.t1190
  - cve.2026-100673

YARA Rule

rule CVE_2026_100673_Grav_DataManager_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Grav Data Manager (CVE-2026-100673) in saved form data or rendered admin output"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100673"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "<script" nocase
        $b = "onmouseover=" nocase
        $c = "onerror=" nocase
        $d = "onload=" nocase
        $e = "javascript:" nocase
        $f = "<svg" nocase
        $g = "<img" nocase
        $h = "<iframe" nocase

    condition:
        filesize < 512KB and
        any of ($a, $b, $c, $d, $e, $f, $g, $h)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100673 Grav Data Manager Stored XSS Payload Submission"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"datamanager"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; sid:2026100673; rev:1; classtype:web-application-attack; reference:cve,2026-100673; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and
     stringContains(http.request.body, "<script") and
     stringContains(http.request.body, "onerror=")]
  [http where http.request.method == "POST" and
     stringContains(http.request.body, "onmouseover=")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval body=coalesce(form_data, request_body, "")
| where method="POST" AND (like(url, "%datamanager%") AND
    (match(body, "(?i)<script") OR match(body, "(?i)on(error|load|mouseover)\s*=") OR match(body, "(?i)javascript:")))
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls by clientip
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-100673,">
  <rule id="100673" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>datamanager</match>
    <regex type="pcre2">(?i)(<script|onerror\s*=|onmouseover\s*=|onload\s*=|javascript:)</regex>
    <description>CVE-2026-100673: Possible Grav Data Manager stored XSS payload submitted via POST</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade the Data Manager plugin to version 1.4.5, which the NVD description states fixes the issue. Because tracked patch evidence is absent, verify the plugin changelog and vendor repository before relying on the fix.
• If immediate upgrade is not possible, migrate the administrative interface to Grav 2.0 Admin Next, which renders the same data through a separate, correctly escaping code path and is not affected.
• Restrict administrator access to the classic admin panel, and enforce least privilege and strong MFA on admin accounts to reduce the impact of script execution in an admin session.
• Review and limit front-end forms whose submissions are stored to user/data, and consider disabling Data Manager front-end ingestion until patched.

2. Patch/upgrade steps

• Update getgrav/grav-plugin-datamanager to 1.4.5 or later.
• Confirm the deployed version on each Grav instance that uses the plugin.
• Re-validate that the classic admin panel no longer renders stored entries unescaped.

3. Long-term hardening

• Apply output encoding by default in Twig templates and avoid Twig's raw filter on user-controlled data.
• Do not rely on strip_tags()/striptags for XSS protection, since allowed tags may retain attributes.
• Enforce a Content Security Policy to limit inline script execution in the admin origin.
• Add regression tests for XSS escaping in plugin templates and monitor plugin/form submissions for HTML payloads.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100673
• Grav Data Manager plugin repository: https://github.com/getgrav/grav-plugin-datamanager (returned 404 — verify manually)
• Grav project: https://getgrav.org
• CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html
• CISA KEV: Not applicable — CVE-2026-100673 is not listed as of this report.

No public PoC, exploit code, or evidence of in-the-wild exploitation or named threat actor campaigns was identified in the provided data.