CVE-2026-61456 Details
Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.
A stored cross-site scripting vulnerability has been identified in the Grav API plugin, specifically in versions prior to 1.0.3. The issue arises from the plugin's media upload handling, which fails to properly sanitize SVG files uploaded through the POST /api/v1/media endpoint. The vulnerability allows authenticated attackers with media upload permissions to inject arbitrary JavaScript into SVG files. These files are saved unaltered and served with the image/svg+xml content type. When an administrator accesses the SVG file in a browser, the embedded script executes in the context of the administrator's session, potentially leading to cookie theft and session hijacking.
Users are advised to update to Grav API Plugin version 1.0.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-stored-xss-via-svg-upload-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav API | <= 1.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |