CVE-2026-61607Medium· 4.6▾ Sunlit

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score25/ 100 · Low

impact 25.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 19, 2026

Updated

Sep 9, 2026

CVSS

4.6

Vendor

—

Product

—

CWE

CWE-79

Depth score

25 · Low

EPSS

0.26% · p17

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Sep 9.

0.2% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 23 days

Aug 19, 2026Published
Disclosed via NVD
Sep 9, 2026Record revised
Last analysed / modified upstream
Sep 9, 2026EPSS first tracked
0.2%
Sep 11, 2026EPSS peak
0.2% → 0.3%

CWE-79 #nvd

Full technical detail▾

Overview

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed