getgrav Grav up to 1.0.2 SVG File /api/v1/media processUploadedFile unrestricted upload

Summaryinfo

A vulnerability was found in getgrav Grav up to 1.0.2. It has been classified as critical. This impacts the function HandlesMediaUploads::processUploadedFile of the file /api/v1/media of the component SVG File Handler. Performing a manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2026-61456. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in getgrav Grav up to 1.0.2. It has been classified as critical. This affects the function HandlesMediaUploads::processUploadedFile of the file /api/v1/media of the component SVG File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-61456 since 07/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 1.0.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42905). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• getgrav

Name

• Grav

Version

• 1.0.0
• 1.0.1
• 1.0.2

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion