CVE-2026-61607
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.
Impact
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/getgrav/grav-plugin-api/commit/d25eedb84a387f2c71b12a374f2a4b3d74339a7e
- https://github.com/getgrav/grav-plugin-api/releases/tag/1.0.2
- https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p
- https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p