CVE-2026-74908 getgrav CVE debrief

Who should care

Grav site administrators and defenders should assess exposure and prioritize remediation due to the medium severity and potential for script injection attacks. They should verify plugin-api versions, restrict api.media.write permissions, and monitor for suspicious activity to prevent exploitation. Additionally, security teams should review compensating controls and implement measures to detect and prevent script injection attacks.

Why it matters

CVE-2026-74908 is a medium-severity vulnerability in Grav plugin-api that allows attackers to upload executable payloads, requiring defenders to verify and update plugin-api, restrict permissions, and monitor for suspicious activity.

• Defenders must verify plugin-api versions and restrict upload permissions to prevent exploitation
• Site administrators should monitor for suspicious file uploads and payload execution to detect potential attacks
• Remediation priority is medium due to the CVSS score of 5.1 and potential for script injection

Technical summary

The Grav plugin-api before 1.0.15 contains a script injection vulnerability due to inadequate SVG sanitization, allowing attackers with api.media.write permission to upload malicious files that execute in the site origin. This vulnerability can be exploited by uploading files with executable script payloads, such as .svgz and .xhtml files, which bypass sanitization. To address this vulnerability, defenders should verify and update plugin-api versions, restrict upload permissions, and monitor for suspicious file uploads and payload execution.

Defensive priority

Medium priority for Grav site administrators and defenders to verify and update plugin-api versions, restrict upload permissions, and monitor for suspicious file uploads and payload execution.

Recommended defensive actions

• Verify and update Grav plugin-api to version 1.0.15 or later
• Restrict api.media.write permissions to trusted users
• Monitor for suspicious file uploads and payload execution
• Implement additional security measures to detect and prevent script injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the script injection vulnerability in Grav plugin-api before 1.0.15, allowing attackers to upload malicious files. However, specific details on affected versions, exploitation, and remediation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.