---
id: CVE-2026-74908
title: >-
  Grav plugin-api before 1.0.15 contains a script injection vulnerability where
  the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz
  and .xhtml files to bypass sanitization and be stored unsanitized
summary: >-
  Grav plugin-api before 1.0.15 contains a script injection vulnerability where
  the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz
  and .xhtml files to bypass sanitization and be stored unsanitized. Attackers
  with a…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74908'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-66xf-ggf4-6hmc'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-plugin-api-before-script-injection-via-svg
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00255
epssPercentile: 0.1516
ingestedAt: '2026-09-08T21:11:12.279Z'
---

## Overview

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.