Description

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-19T16:18:16.723Z",
  "pubdate": "2026-08-19T16:18:16.723Z",
  "executiveSummary": "An arbitrary file upload vulnerability leading to Stored Cross-Site Scripting (XSS) exists in the Grav API Plugin for Grav CMS prior to version 1.0.2. The flaw resides within the POST /api/v1/media endpoint and the HandlesMediaUploads::processUploadedFile() function, which fails to properly sanitize Scalable Vector Graphics (SVG) files containing executable JavaScript. An authenticated attacker possessing api.media.write permissions can upload a malicious SVG file to the server. When subsequently retrieved, the server responds with a Content-Type header of image/svg+xml, causing the embedded script to execute within the context of a victim's browser session. Successful exploitation enables severe security impacts, including session data theft, unauthorized account takeover, and the execution of arbitrary authenticated actions against the affected Grav CMS instance. Exploitation requires valid API write privileges and network access to the target RESTful API interface.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and sanitization within the media upload pipeline of the Grav API Plugin. Specifically, the vulnerable component is located in the HandlesMediaUploads::processUploadedFile() function, which handles incoming file uploads via the POST /api/v1/media REST endpoint. While the implementation performs a basic validation check to ensure the uploaded file possesses an SVG filename extension, it fails to invoke the critical Security::sanitizeSVG() method. SVG files are XML-based documents capable of encapsulating arbitrary executable scripts within elements such as <script> or via event handlers embedded in graphical tags.\nThe attack flow proceeds as follows: First, an authenticated attacker authenticates to the RESTful API and targets the POST /api/v1/media pipeline with api.media.write privileges. The attacker crafts a payload consisting of a malicious SVG file containing embedded JavaScript designed to execute malicious logic, such as extracting session cookies or performing unauthorized state-changing API requests. Second, the server receives the upload request, validates only the file extension, and stores the malicious file within the application's media repository without stripping the executable script content. Third, when a victim requests or views the uploaded media asset, the server serves the file with the Content-Type header set to image/svg+xml. Finally, upon rendering the SVG document, the victim's browser parses and executes the embedded JavaScript payload within the security context of the application's origin.\nThis behavior facilitates post-exploitation activities including session hijacking, credential exposure, and the execution of arbitrary administrative or user-level actions on behalf of the victim. The affected versions comprise all releases of the Grav API Plugin prior to version 1.0.2. Network exposure is constrained to endpoints serving the REST API, and exploitation is strictly dependent on the attacker acquiring api.media.write access privileges prior to initiating the file upload sequence."
}