CVE-2026-74908
Received Received - Intake

SVG Script Injection in Grav Plugin-API

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulnCheck

Description
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-74908
EUVD
EUVD-2026-60589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav plugin-api to 1.0.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Grav plugin-api before 1.0.15 involves a script injection flaw where the SVG sanitizer only checks for the exact extension 'svg'. This allows attackers to bypass sanitization by uploading files with extensions like .svgz or .xhtml. These unsanitized files can contain executable scripts that run when accessed by users.

Detection Guidance

Check for uploaded files with extensions like .svgz or .xhtml in Grav CMS media directories. Review server logs for suspicious API media uploads by users with api.media.write permission. Inspect files for embedded scripts or unexpected content types.

Impact Analysis

Attackers with api.media.write permission can upload malicious files that execute scripts when viewed by administrators or visitors. This could lead to unauthorized actions, data theft, or defacement of the website. Users accessing infected files may have scripts executed in their browsers.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if user data is compromised through this exploit.

Mitigation Strategies

Upgrade Grav plugin-api to version 1.0.15 or later. Expand the denylist to block .svgz and .xhtml extensions. Implement content-based sanitization for SVG files instead of relying on file extensions. Remove any unsanitized files already uploaded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart