Grav plugin-api CVE-2026-74908

Exploitation requires that the attacker hold valid credentials for an account explicitly granted the api.media.write permission on the target Grav installation - this permission is not assigned by default and must be deliberately provisioned. Execution of the payload is further conditioned on a separate victim (administrator or site visitor) accessing or rendering the uploaded file through a browser after upload (CVSS UI:P); the script does not execute server-side at upload time. Limiting factors: api.media.write must be reachable and granted to an account under attacker control; the attack cannot self-trigger after upload; and the payload only executes within the browser's rendering of the specific file, constraining impact to origin-level XSS rather than server-side code execution.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) reflects a moderate and well-bounded risk: the attack is network-accessible with low complexity but is gated by a required low-privilege credential (api.media.write) and passive victim interaction before payload execution. No EPSS score is available in the provided intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no public exploit code is referenced - exploitation status is unconfirmed at time of analysis. The stored-XSS nature of this flaw meaningfully elevates real-world impact relative to reflected XSS: a single successful upload persists until remediated and can affect multiple victims over time, meaning even a mid-sized municipal IT team in boleslawiec should treat this as a medium-priority patch rather than a backlog item. The narrow api.media.write permission prerequisite substantially limits the realistic attacker pool to insider threats, compromised low-privilege API accounts, or scenarios where that permission is over-provisioned. No conflicting signals between data sources are present, but the absence of EPSS and POC data leaves exploitation probability genuinely uncertain.

An attacker who has obtained api.media.write credentials - through account compromise, insider access, or over-provisioned API tokens - crafts a .svgz file embedding a JavaScript payload targeting session cookies or CSRF actions. The file is submitted to the media upload API endpoint and stored on the server without sanitization because the extension check does not match 'svgz'. When an administrator later browses the media library or a visitor accesses a page rendering the file, the embedded script executes in the Grav site's origin, exfiltrating the victim's session token to an attacker-controlled endpoint.