Grav API Plugin CVE-2026-61607

The attacker must possess a valid API token or credential with the api.media.write permission explicitly granted; this permission is not available to unauthenticated users and is not a default low-privilege role, restricting the attacker pool to authorized API consumers or insider threat actors. After the malicious SVG is uploaded, a second user (the victim) must open the stored file URL in a browser that renders it as an active SVG document. Exploitation is further limited by: (1) deployment scope - only Grav CMS installations with the API plugin installed and the API endpoint network-accessible are affected; (2) the need for victim interaction, meaning automated mass exploitation without social engineering is not feasible; and (3) the absence of a scope change to the underlying server, so the attacker cannot leverage this path alone to achieve server-side code execution.

The NVD CVSS 3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) accurately reflects the primary limiting factors: the attacker must hold api.media.write permission (PR:L), and a victim must actively open the stored SVG (UI:R). These prerequisites meaningfully constrain the realistic attacker population to compromised API credential holders or malicious insiders - the vulnerability is not exploitable by anonymous external attackers. The NVD assignment of S:U (unchanged scope) is debatable; stored XSS that executes in a separate user's browser session represents a classical scope change, and S:C would yield a higher score - this is flagged as an area where analysts may differ. No EPSS data was included in the provided intelligence, the CVE is not listed in CISA KEV, and no public POC has been identified. Real-world risk is moderate-low: the api.media.write permission gate substantially reduces exposure, and the primary impact (session hijacking, impersonation) is meaningful but does not include remote code execution or data destruction. Organizations running Grav with the API plugin exposed to untrusted API consumers represent the highest-risk deployments.

An attacker who has obtained valid API credentials with api.media.write permission crafts an SVG file containing a JavaScript payload that exfiltrates the victim's session cookie or JWT token to an attacker-controlled server. After uploading the file via POST /api/v1/media, the attacker distributes the resulting SVG URL to a privileged administrator (e.g., via a phishing message referencing a legitimate-looking media asset). When the administrator opens the URL in a browser, the SVG is rendered as an active document, the script executes, and session credentials are delivered to the attacker - who can then replay them to take over the administrator's account. No public POC has been identified at time of analysis.