CVE-2026-74908
MediumCVSS 4.6Summary
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.
Risk Assessment
The risk is the possibility of executing malicious scripts in the site's origin, which can lead to data theft, session hijacking, or other attacks. The vulnerability can be exploited by users with file upload permissions.
Recommendation
It is recommended to upgrade Grav plugin-api to version 1.0.15 or later, which includes the fix. Also extend the SVG sanitizer to handle other extensions such as .svgz and .xhtml.
Original NVD description (English source)
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.