GetGrav Grav API Plugin up to 1.0.1 Media Upload /api/v1/media processUploadedFile unrestricted upload

Summaryinfo

A vulnerability was found in GetGrav Grav API Plugin up to 1.0.1. It has been rated as critical. Affected is the function HandlesMediaUploads::processUploadedFile of the file /api/v1/media of the component Media Upload Handler. Performing a manipulation results in unrestricted upload. This vulnerability was named CVE-2026-61607. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in GetGrav Grav API Plugin up to 1.0.1. This affects the function HandlesMediaUploads::processUploadedFile of the file /api/v1/media of the component Media Upload Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-61607 since 07/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 1.0.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• GetGrav

Name

• Grav API Plugin

Version

• 1.0.0
• 1.0.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion