CVE-2026-61607: Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav API Pluginto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs api.media.write permission and must be able to submit an SVG through the POST /api/v1/media endpoint. Exploitation also requires a victim to open the uploaded SVG.
Which installations are affected?
Grav API Plugin versions prior to 1.0.2 are affected. The vulnerable upload path is HandlesMediaUploads::processUploadedFile(), which accepts SVG files based on their filename extension without invoking SVG sanitization.
What is the impact if a malicious SVG is opened?
Because the server returns the uploaded file as image/svg+xml, JavaScript embedded in the SVG can execute in the victim's browser. This can enable theft of session data and authenticated actions as the victim.
What should be done if updating is not immediately possible?
The provided information identifies api.media.write as the permission required to upload the malicious SVG. Restrict that permission to trusted users and prevent untrusted SVG uploads through the API media endpoint until the plugin can be updated to 1.0.2.