Alienkeric

siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 2.0.4 **Description** Improper session invalidation occurs because JSON Web Tokens (JWT) access tokens are issued without a `jti` (JWT ID) claim, preventing server-side revocation. While refresh tokens can be managed, access tokens remain valid for their entire duration (defaulting to 1 hour) even after a user logs out, changes their password, receives a new token, or has their account disabled. This allows an attacker with a stolen access token to maintain full API access until the token expires naturally. **Recommendations** Update Grav API plugin to version 2.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Grav version 2.0.0 **Description** An issue exists where the XSS blueprint validator `Security::detectXss()` processes raw page content before Twig processing occurs. If Twig content processing is enabled via `twig content.process enabled: true`, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via `{{ page.content|raw }}`. **Recommendations** Update Grav to version 2.0.1. Disable the `twig content.process enabled` setting to prevent Twig content processing.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.3 **Description** A file upload extension bypass exists in the API media controller. The function `validateFileExtension()` only inspects the final file extension using `pathinfo($filename, PATHINFO EXTENSION)`, allowing a user with `api.media.write` permission to upload files with double extensions, such as shell.php.jpg, to bypass the blocklist of dangerous extensions. This can lead to remote code execution if the web server executes the uploaded file as PHP. **Recommendations** Update Grav API plugin to version 1.0.3 or later.

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to the web root or other sensitive directories.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.1 **Description** A decompression bomb issue exists in the `ZipArchiver::extract()` function. The function does not impose limits on the number of files, nesting depth, or the total uncompressed size of archives. An attacker can provide a specially crafted ZIP archive that expands to consume all available disk space, resulting in a denial of service by exhausting storage resources. **Recommendations** Update Grav to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.3 **Description** Insufficient sanitization of SVG files uploaded via the 'POST /api/v1/media' endpoint allows an authenticated attacker with `api.media.write` permission to upload a file containing arbitrary JavaScript. The `HandlesMediaUploads::processUploadedFile()` function only validates the file extension and fails to call `Security::sanitizeSVG()`. Because the file is stored unmodified and served as `image/svg+xml`, the embedded script executes in the session context of an administrator who opens the file, potentially leading to cookie theft and session hijacking. **Recommendations** Update Grav API plugin to version 1.0.3 or later. Restrict the use of the `api.media.write` permission to trusted users only.