Description

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-18T12:19:31.190Z",
  "pubdate": "2026-08-18T12:19:31.190Z",
  "executiveSummary": "An arbitrary file upload and script injection vulnerability exists in the Grav plugin-api prior to version 1.0.15. The flaw resides within the application's media sanitization mechanisms, which improperly restrict file validation solely to the exact extension 'svg'. Consequently, attackers are able to upload alternative vector and XML-based markup formats, specifically .svgz and .xhtml files, bypassing the intended security controls and allowing unsanitized payloads to be stored on the server.\nSuccessful exploitation of this vulnerability allows authenticated threat actors possessing api.media.write permissions to upload malicious files containing executable script payloads. When these stored files are subsequently accessed by site administrators or regular visitors, the payloads execute within the context of the vulnerable site origin, leading to potential session hijacking, data exfiltration, or unauthorized administrative actions. The risk implications are severe due to the potential for persistent cross-site scripting (XSS) and client-side compromise. Remediation requires updating the plugin-api to version 1.0.15 or later to ensure comprehensive sanitization of all vector-based and markup file formats.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and overly restrictive extension checking within the Grav plugin-api SVG sanitizer. Specifically, the sanitization logic validates uploaded media files by verifying if the file extension matches the strict string 'svg'. It fails to account for compressed Scalable Vector Graphics (.svgz) or Extensible HyperText Markup Language (.xhtml) files, which can similarly contain embedded JavaScript, foreign objects, and executable scripts.\nThe vulnerable component is the media upload handling and sanitization routine of the Grav plugin-api in versions prior to 1.0.15. Exploitation requires authenticated access with api.media.write privileges. An attacker leverages this capability to upload a maliciously crafted .svgz or .xhtml file containing an executable script payload, such as an onload event handler executing arbitrary JavaScript. Because the server-side sanitization routine checks only for the literal 'svg' extension, the .svgz or .xhtml files bypass validation and are stored directly within the media repository.\nThe attack flow proceeds as follows: First, the attacker authenticates and obtains the necessary api.media.write permissions. Second, the attacker crafts a malicious payload encapsulated within an .svgz or .xhtml file structure. Third, the attacker issues an upload request to the API endpoint. Fourth, the server processes the file, fails to sanitize the unhandled extensions, and writes the malicious file to disk. Finally, when a victim, such as a privileged site administrator or standard visitor, navigates to the stored file URL within their browser, the embedded script executes in the context of the site origin, leveraging the established trust boundary to perform malicious actions."
}