CVE-2026-61456: Grav before 1.0.3 Stored XSS via SVG Upload API
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.3 - Configuration
Ensure HandlesMediaUploads::processUploadedFile() invokes Security::sanitizeSVG() for SVG uploads instead of validating only the file extension when processing uploads to POST /api/v1/media.
Grav API plugin (getgrav/grav-plugin-api) / HandlesMediaUploads::processUploadedFile() SVG sanitization invocation (Security::sanitizeSVG()) = enabled - Compensating control
Restrict access to the POST /api/v1/media endpoint and the api.media.write permission to trusted users to reduce the risk of authenticated SVG uploads that could execute JavaScript when opened by an administrator.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61456?
CVE-2026-61456 has a medium severity score of 5.1.
How can I fix CVE-2026-61456?
To fix CVE-2026-61456, update the Grav API plugin to version 1.0.3 or later.
What exploit does CVE-2026-61456 allow?
CVE-2026-61456 allows authenticated attackers to upload malicious SVG files that can lead to stored XSS.
Which version of Grav is affected by CVE-2026-61456?
CVE-2026-61456 affects Grav API plugin versions prior to 1.0.3.
What method fails to sanitize SVG uploads in CVE-2026-61456?
The HandlesMediaUploads::processUploadedFile() method fails to invoke Security::sanitizeSVG() for SVG uploads.