PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61607 getgrav CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T16:18:16.723Z and has not been modified since then. The NVD entry is currently MEDIUM. This medium-severity vulnerability in the Grav API Plugin for Grav CMS allows an attacker with api.media.write permission to store malicious SVG files that can execute JavaScript when opened by a victim, leading to session data theft and authenticated actions. The issue exists in versions prior to 1.0.2 and is fixed in version 1.0.2. Administrators and users of Grav CMS with the Grav API Plugin installed should be aware of this vulnerability and take necessary actions to protect their systems.

Vendor
getgrav
Product
grav-plugin-api
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-19
Original CVE updated
2026-09-09
Advisory published
2026-08-19
Advisory updated
2026-09-09

Who should care

Administrators and users of Grav CMS with the Grav API Plugin installed, especially those with api.media.write permission, should be aware of this vulnerability and take necessary actions to protect their systems.

Technical summary

CVE-2026-61607 is a medium-severity vulnerability in the Grav API Plugin for Grav CMS. Prior to version 1.0.2, the plugin's POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript. The server returns the file as Content-Type: image/svg+xml, allowing the script to execute when a victim opens it, leading to session data theft and authenticated actions. The issue is fixed in version 1.0.2.

Defensive priority

CVE-2026-61607 is a medium-severity vulnerability in the Grav API Plugin for Grav CMS, allowing an attacker with api.media.write permission to store malicious SVG files that can execute JavaScript when opened by a victim, leading to session data theft and authenticated actions.

Recommended defensive actions

  • Inventory affected systems using Grav CMS with Grav API Plugin versions prior to 1.0.2
  • Apply the patch by updating Grav API Plugin to version 1.0.2 or later
  • Restrict api.media.write permission to trusted users
  • Monitor for suspicious SVG file uploads and Content-Type: image/svg+xml responses
  • Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent malicious SVG file uploads

Evidence notes

The CVE-2026-61607 issue exists in Grav API Plugin versions prior to 1.0.2. An attacker with api.media.write permission can store an SVG containing JavaScript. The server returns the file as Content-Type: image/svg+xml, allowing the script to execute when a victim opens it. This enables session data theft and authenticated actions. The issue is fixed in version 1.0.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-61607 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-61607

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-61607 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61607

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.