CVE-2026-61607 getgrav CVE debrief

Who should care

Administrators and users of Grav CMS with the Grav API Plugin installed, especially those with api.media.write permission, should be aware of this vulnerability and take necessary actions to protect their systems.

Technical summary

CVE-2026-61607 is a medium-severity vulnerability in the Grav API Plugin for Grav CMS. Prior to version 1.0.2, the plugin's POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript. The server returns the file as Content-Type: image/svg+xml, allowing the script to execute when a victim opens it, leading to session data theft and authenticated actions. The issue is fixed in version 1.0.2.

Defensive priority

CVE-2026-61607 is a medium-severity vulnerability in the Grav API Plugin for Grav CMS, allowing an attacker with api.media.write permission to store malicious SVG files that can execute JavaScript when opened by a victim, leading to session data theft and authenticated actions.

Recommended defensive actions

• Inventory affected systems using Grav CMS with Grav API Plugin versions prior to 1.0.2
• Apply the patch by updating Grav API Plugin to version 1.0.2 or later
• Restrict api.media.write permission to trusted users
• Monitor for suspicious SVG file uploads and Content-Type: image/svg+xml responses
• Implement compensating controls such as Web Application Firewalls (WAFs) to detect and prevent malicious SVG file uploads

Evidence notes

The CVE-2026-61607 issue exists in Grav API Plugin versions prior to 1.0.2. An attacker with api.media.write permission can store an SVG containing JavaScript. The server returns the file as Content-Type: image/svg+xml, allowing the script to execute when a victim opens it. This enables session data theft and authenticated actions. The issue is fixed in version 1.0.2.

Official resources