Grav prior to version 2.0.14 contains a stored XSS vulnerability in the Security::detectXss() function located in system/src/Grav/Common/Security.php. The vulnerability arises because all XSS detection patterns use the PCRE /u (UTF-8) modifier. If page content contains a single invalid UTF-8 byte, preg_match() returns false for every pattern, causing the Validation::checkSafety() XSS safety gate to be silently bypassed. This allows an authenticated attacker with page-edit permissions (but without the security.xss_whitelist privilege) to store malicious JavaScript that executes when a visitor views the affected page.

An attacker with authenticated page-edit permissions can store malicious JavaScript on the site that executes in the browsers of visitors viewing the affected page. This bypasses the intended XSS protection mechanism, potentially leading to client-side script execution, data theft, or session hijacking. The vulnerability requires authentication and specific permissions, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the advisory is a duplicate and withdrawn, consult the original advisory GHSA-q2j8-x8hf-63ch for official patch or mitigation details. Until patched, restrict page-edit permissions to trusted users and monitor for suspicious content.