CVE-2026-61456

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.3

Description Insufficient sanitization of SVG files uploaded via the 'POST /api/v1/media' endpoint allows an authenticated attacker with api.media.write permission to upload a file containing arbitrary JavaScript. The HandlesMediaUploads::processUploadedFile() function only validates the file extension and fails to call Security::sanitizeSVG(). Because the file is stored unmodified and served as image/svg+xml, the embedded script executes in the session context of an administrator who opens the file, potentially leading to cookie theft and session hijacking.

Recommendations Update Grav API plugin to version 1.0.3 or later. Restrict the use of the api.media.write permission to trusted users only.