CVE-2026-61607
MediumCVSS 4.6Summary
The Grav API plugin prior to 1.0.2 in the POST /api/v1/media pipeline validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions.
Risk Assessment
An attacker can steal session data and perform authenticated actions on behalf of the victim, potentially compromising confidentiality and integrity.
Recommendation
Update the Grav API plugin to version 1.0.2 or later and restrict api.media.write permissions to trusted users.
Original NVD description (English source)
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.