CVE-2026-61456

Description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.

PUBLISHED Reserved 2026-07-09 | Published 2026-07-10 | Updated 2026-07-10 | Assigner VulnCheck

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Credits

alienkeric reporter

References

github.com/...v/grav/security/advisories/GHSA-7vhm-8x52-2r5p exploit

github.com/...v/grav/security/advisories/GHSA-7vhm-8x52-2r5p (GitHub Security Advisory (GHSA-7vhm-8x52-2r5p)) vendor-advisory

www.vulncheck.com/...av-before-stored-xss-via-svg-upload-api (VulnCheck Advisory: Grav before 1.0.3 Stored XSS via SVG Upload API) third-party-advisory

cve.org (CVE-2026-61456)

nvd.nist.gov (CVE-2026-61456)

Download JSON