Is there a patch available for CVE-2026-61456?

Yes, a patch is available for CVE-2026-61456. Update the affected software to the latest version immediately.

Grav API Plugin CVE-2026-61456

Q: What is the CVSS score of CVE-2026-61456?

CVE-2026-61456 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42905 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 VulnCheck

GHSA-g78v-pr5g-35v2

XSS Grav Getgrav

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network vector via API upload, low privilege (api.media.write account), user interaction required (admin opens SVG), scope changes as script executes in admin browser context, limited C and I impact from session theft.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 16:16 EUVD

Analysis Generated

Jul 10, 2026 - 16:04 vuln.today

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.

AnalysisAI

Stored XSS in the Grav API plugin (getgrav/grav-plugin-api) before version 1.0.3 allows an authenticated attacker holding the api.media.write permission to upload a malicious SVG file that executes arbitrary JavaScript in an administrator's browser session. The POST /api/v1/media endpoint's HandlesMediaUploads::processUploadedFile() method validates only the file extension and never calls Security::sanitizeSVG(), so the uploaded file is stored and served verbatim with Content-Type: image/svg+xml. When an administrator opens the file directly or via an embedded object or iframe, the injected script runs in the admin's authenticated session context, enabling cookie theft and full session hijacking. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Grav is a flat-file CMS that offers an optional REST API via the grav-plugin-api package. The affected endpoint, POST /api/v1/media, delegates file handling to the HandlesMediaUploads trait's processUploadedFile() method, which performs only a file-extension check rather than invoking Grav's built-in Security::sanitizeSVG() sanitization utility. The SVG image format (XML-based) natively supports embedded ECMAScript via <script> tags and event handlers; when a browser fetches such a file served with the image/svg+xml content type, it executes the embedded JavaScript in the context of the serving origin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): untrusted content is persisted server-side and later rendered in a privileged browser context without sanitization. The CPE provided (cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) identifies the Grav ecosystem broadly; the specific vulnerable component is the API plugin, versions prior to 1.0.3.

RemediationAI

Upgrade grav-plugin-api to version 1.0.3 or later, which corrects the vulnerability by invoking Security::sanitizeSVG() in the processUploadedFile() method. The vendor advisory is at https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p. If immediate upgrade is not possible, restrict the api.media.write permission to only the most trusted, internally managed accounts, eliminating the ability for external or low-privilege users to upload media via the API endpoint. As a secondary compensating control, configure the web server (nginx or Apache) to override the content type for SVG files in the media upload directory, serving them as application/octet-stream or text/plain rather than image/svg+xml; this prevents browser execution of embedded scripts but may break legitimate SVG rendering for users. Note that the content-type override workaround has a trade-off: it will affect all SVG media served from that path, including legitimate files, and does not prevent malicious file storage - it only blocks in-browser execution.