CVE-2026-74908: Grav plugin-api before 1.0.15 Script Injection via SVG

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-79

Description

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

Affected products

getgrav grav: before 1.0.15 — fixed in 1.0.15

How to fix

Upgrade to a fixed version: getgrav grav 1.0.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-74908 or the next vulnerability affects your stack