EUVD-2026-62533Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Stored XSS executing in a victim's browser context crosses security scope (S:C); PR:L reflects the mandatory api.media.write credential requirement.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.
AnalysisAI
Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holding api.media.write permission to upload a malicious SVG file whose embedded JavaScript executes in any victim's browser that opens the file. The upload pipeline in HandlesMediaUploads::processUploadedFile() checks the SVG filename extension but omits the Security::sanitizeSVG() call, so script content passes through unmodified and is later served as Content-Type: image/svg+xml, triggering browser-side execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid API token or credential with the api.media.write permission explicitly granted; this permission is not available to unauthenticated users and is not a default low-privilege role, restricting the attacker pool to authorized API consumers or insider threat actors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) accurately reflects the primary limiting factors: the attacker must hold api.media.write permission (PR:L), and a victim must actively open the stored SVG (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Grav API Plugin version 1.0.2, which resolves the vulnerability by invoking Security::sanitizeSVG() within the upload pipeline so that embedded scripts are stripped before the file is persisted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Grav Plugin Api
View allHost header injection in the Grav API plugin's forgot-password endpoint allows unauthenticated remote attackers to redir
Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the
Privilege escalation in Grav API Plugin (all versions before 1.0.6) allows any authenticated user holding the api.users.
Privilege escalation in grav-plugin-api before 1.0.20 allows a low-privileged API manager to self-create a super-admin a
Privilege escalation in grav-plugin-api before 1.0.20 allows authenticated API users holding api.access and api.users.wr
Permissive CORS misconfiguration in the Grav API Plugin (all versions prior to 1.0.0-rc.16) allows cross-origin JavaScri
Scope enforcement is entirely absent in the Grav API Plugin prior to 1.0.6, meaning any scoped API key silently exercise
JWT bearer token leakage in the Grav API Plugin for Grav CMS (prior to 1.0.0-rc.16) exposes valid access tokens to any p
Stored XSS in Grav CMS's grav-plugin-api (Admin2) allows a low-privileged editor to persist malicious JavaScript in page
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today