CVE-2026-74908 in Grav
Summary
by MITRE • 08/18/2026
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Grav plugin-api versions prior to 1.0.15 represents a critical failure in input validation and sanitization mechanisms, specifically within the file handling subsystem responsible for processing uploaded media assets. The core technical flaw lies in an overly restrictive yet insufficiently comprehensive extension check implemented by the SVG sanitizer module. Rather than employing a robust method such as MIME type verification or deep content inspection to determine if a file is truly safe, the system relies exclusively on string matching against the literal suffix svg. This approach creates a predictable bypass vector where attackers can exploit case-insensitive filesystem behaviors and alternative archive formats that are functionally equivalent to SVG files but possess different extensions. Specifically, the sanitizer fails to recognize .svgz (gzip-compressed SVG) or .xhtml files as potential vectors for malicious content, allowing these file types to pass through validation checks without undergoing the necessary sanitization processes designed to strip out executable script tags and event handlers.
From an operational perspective, this flaw enables a Stored Cross-Site Scripting attack that requires authentication with specific privileges. An attacker possessing api.media.write permissions can upload files disguised as .svgz or .xhtml documents containing embedded JavaScript payloads. Because these files are stored on the server without sanitization, they retain their executable code intact. When an administrator or any other user with access to view media content accesses these uploaded files through a web browser, the malicious scripts execute within the context of the site's origin. This execution environment grants the attacker significant leverage, as it allows for session hijacking, credential theft via keylogging, defacement of the website interface, and potentially further lateral movement if combined with other vulnerabilities or misconfigurations that allow access to sensitive administrative functions.
The security implications are severe because they undermine the trust model of the application's media management system. By bypassing sanitization, attackers effectively turn a standard file upload feature into an arbitrary code execution vector within the browser context. This aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, the specific technique of using alternative extensions to evade detection mechanisms is characteristic of CWE-20, indicating improper input validation where the system fails to adequately restrict or validate inputs based on their actual content rather than just superficial attributes like file extension. The attack vector also maps to MITRE ATT&CK techniques related to Initial Access and Execution via Web Shell components, although in this specific instance, it functions more as a persistent stored XSS payload that can be triggered repeatedly by multiple users.
Mitigation strategies must focus on immediate patching and enhanced validation practices. Administrators running Grav installations with the plugin-api module should upgrade immediately to version 1.0.15 or later, where the sanitization logic has been corrected to handle compressed SVG variants and related XML-based formats correctly. In environments where upgrading is not immediately feasible, temporary mitigations include restricting api.media.write permissions to only those users who absolutely require them, thereby reducing the attack surface for potential exploitation. Additionally, implementing a Content Security Policy (CSP) with strict script-src directives can significantly reduce the impact of any successful XSS attempts by preventing inline scripts from executing unless explicitly whitelisted. Long-term architectural improvements should involve replacing extension-based validation with MIME type verification and using dedicated libraries that perform deep content inspection to ensure uploaded files are truly safe before storage, thereby closing gaps created by simplistic string matching algorithms.