The Grav API plugin contains a flaw that allows an authenticated user with the api.media.write permission to upload SVG files that contain arbitrary JavaScript. Because the plugin does not invoke the Security::sanitizeSVG() routine and only validates the file extension, the malicious SVG is stored exactly as created. When an administrator later opens the file—or if the file is embedded in a page using <object> or <iframe>—the script runs in the context of the administrator’s session, enabling cookie theft and session hijacking. Based on the description, it is inferred that this client‑side execution can ultimately be used to compromise the entire site by leveraging the stolen session credentials.

The vulnerability affects installations of the Grav content‑management system that use the getgrav/grav-plugin-api plugin prior to version 1.0.3. Any site that has the API plugin at a version earlier than 1.0.3 and allows media uploads through the POST /api/v1/media endpoint is susceptible; the issue is tied to the plugin’s version rather than a specific Grav core release. Based on the description, it is inferred that this problem is confined to the plugin and not to the Grav core itself.

The CVSS v3.1 score of 5.1 indicates a moderate security risk. The EPSS score of 0.00141 shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with permission to write media, but once that prerequisite is met, the exploitation path is straightforward: upload a crafted SVG, wait for an administrator to retrieve it, and trigger client‑side code execution, resulting in administrative access through session hijacking that can lead to full compromise of the site. Based on the description, it is inferred that the attacker can hijack the administrator’s session and then use that session to gain unrestricted control over the site.