CVE-2026-61607
Received Received - Intake

Stored XSS in Grav API Plugin via Unsanitized SVG Upload

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-61607
EUVD
EUVD-2026-62533

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_api_plugin to 1.0.2 (exc)
getgrav grav_api_plugin From 1.0.3 (inc)
getgrav grav_cms to 1.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Grav API Plugin for Grav CMS. It allows an attacker with the api.media.write permission to upload a malicious SVG file containing JavaScript. The file bypasses SVG sanitization because the sanitizeSVG() function is not called during API media uploads. When the SVG is served with the image/svg+xml MIME type, browsers execute the embedded script, enabling session hijacking or credential theft.

Detection Guidance

Check Grav CMS versions for API plugin 1.0.2 or earlier. Inspect uploaded SVG files for embedded JavaScript or unusual filenames. Review server logs for unauthorized API media uploads with api.media.write permission.

Impact Analysis

An attacker could steal session data or perform authenticated actions on your behalf if you view the malicious SVG. This could lead to unauthorized access to your Grav CMS account or other sensitive actions. The impact requires the attacker to have api.media.write permission and for you to access the SVG file.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using Grav CMS with the affected API plugin may face compliance risks if exploited, potentially resulting in data breaches and regulatory penalties.

Mitigation Strategies

Upgrade Grav API plugin to version 1.0.2 or later. Remove or sanitize existing untrusted SVG files. Restrict api.media.write permission to trusted users only. Review and update file upload validation rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart