Grav API Plugin EUVD-2026-42905

Exploitation requires the attacker to hold a Grav API account with the api.media.write permission explicitly granted - this permission controls write access to the /api/v1/media endpoint and is not a default or low-barrier condition. Beyond the authenticated upload step, successful exploitation further requires passive user interaction (CVSS UI:P): an administrator must open the malicious SVG file in a browser, either by navigating to its URL directly or by loading a page that embeds it via an <object> or <iframe> element. Exploitation is limited to versions of grav-plugin-api prior to 1.0.3, and only affects deployments where the Grav API plugin is installed and active. The two combined limiting factors - pre-authenticated API access with specific write permissions and administrator browser interaction - substantially reduce the realistic attack surface compared to unauthenticated or no-interaction vulnerabilities.

The CVSS 4.0 score of 5.1 (Medium) is consistent with the attack's realistic constraints. The vector PR:L confirms that an authenticated user with the api.media.write permission is required - unauthenticated exploitation is not possible. UI:P reflects that administrator interaction (opening the SVG in a browser) is a necessary precondition, adding a social engineering dependency. No EPSS score was provided; no KEV listing exists and no public exploit or POC has been identified at time of analysis. The combination of these factors means real-world risk is moderate and largely dependent on two limiting conditions: (1) whether the api.media.write permission is granted to potentially untrusted or compromised accounts, and (2) whether an administrator can be induced to open attacker-uploaded media files. The impact ceiling - session hijacking of an admin account - is meaningfully high if both conditions are met, making this a priority for sites where the API is exposed to external or low-trust authenticated users. The CVSS 4.0 scope metrics (SC:N/SI:N/SA:N) indicate impact is confined to the vulnerable Grav system and does not cascade to other services.

An attacker with api.media.write API access crafts an SVG file embedding a JavaScript payload such as a fetch() call that exfiltrates document.cookie to an attacker-controlled endpoint, then uploads it via a POST request to /api/v1/media. The attacker then sends a Grav administrator a link to the stored SVG file (e.g., in a support ticket, internal message, or by embedding it in a public Grav page via an <object> tag) and waits for the administrator to open it; upon browser rendering, the embedded script executes in the admin's origin context and transmits the session token, granting the attacker full administrative access to the Grav installation. No public POC has been identified, but the technique is well-understood and straightforward for any attacker familiar with SVG-based XSS.