CVE-2026-74908: Grav plugin-api before 1.0.15 Script Injection via SVG
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
Users or service accounts with the api.media.write permission can upload the crafted files. The script runs only when an administrator or visitor accesses the uploaded .svgz or .xhtml file, so exploitation requires both upload permission and a target to open or otherwise access the file.
Which file types can bypass the sanitizer?
The affected sanitizer checks only for the exact svg extension. Files using .svgz or .xhtml can bypass sanitization and be stored with executable script content.
How can I determine whether my deployment may already be affected?
Exposure is present if the Grav plugin-api version is earlier than 1.0.15 and an account has api.media.write permission. Review uploaded media for .svgz and .xhtml files, particularly files uploaded by untrusted or lower-privileged users.
What can be done if updating is not immediately possible?
Until the plugin is updated to 1.0.15 or later, restrict api.media.write to trusted users and prevent uploads of .svgz and .xhtml files. Treat existing files with those extensions as potentially containing active script content and avoid accessing them in the site origin.