CVE-2026-61607

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.2

Description The plugin fails to invoke the Security::sanitizeSVG() function within the HandlesMediaUploads::processUploadedFile() function when processing the 'POST /api/v1/media' endpoint. While the SVG filename extension is validated, the content is not sanitized. An attacker with api.media.write permission can upload an SVG file containing malicious JavaScript. Because the server returns the file with the image/svg+xml Content-Type, the script executes in the victim's browser, potentially leading to session data theft and unauthorized authenticated actions.

Recommendations Update Grav API Plugin to version 1.0.2.