Remote Code Execution Flaw in Grav API Plugin for Grav CMS
CVE-2026-61607

4.6MEDIUM

Key Information:

Vendor

Getgrav

Status
Grav-plugin-api
Vendor
CVE Published:
19 August 2026

What is CVE-2026-61607?

The Grav API Plugin, essential for providing RESTful API access to Grav CMS, has a vulnerability where it inadequately handles the validation of SVG filenames. Specifically, prior to version 1.0.2, the plugin allows attackers with the 'api.media.write' permission to upload SVG files that may contain JavaScript. The server inadequately sanitizes these SVGs, leading to a scenario where, upon retrieval, the malicious script executes. This execution can lead to theft of session data as well as unauthorized actions by the victim. Updating to version 1.0.2 effectively resolves this issue by ensuring proper sanitization of SVG uploads.

Affected Version(s)

grav-plugin-api < 1.0.2

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/getgrav/grav-plugin-api/commit/d25eedb...
x_refsource_MISC
https://github.com/getgrav/grav-plugin-api/releases/tag/1...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.