The Grav API plugin’s POST /api/v1/media route validates the SVG file extension but omits a call to the sanitization routine. This oversight allows an attacker with api.media.write permission to upload an SVG that contains embedded JavaScript. When a user later opens the uploaded file, the server serves it with the Content‑Type image/svg+xml header, causing the browser to execute the script in the context of the site. The embedded code can read the receiving user’s session cookie and issue authenticated actions on their behalf, effectively enabling session hijacking and privilege escalation within the site’s scope.

The vulnerability affects the Grav API plugin for the Grav CMS, specifically all releases prior to version 1.0.2. The fix was introduced in release 1.0.2, which restores the missing call to Security::sanitizeSVG(). The plugin is provided by getgrav under the project name grav-plugin‑api.

The CVSS vector indicates a medium severity (4.6). EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to possess api.media.write permission, which normally is granted only to trusted users or administrators. Therefore the likelihood of broad exploitation is moderate; however, if an attacker can obtain such permission or trick an authorized user into uploading a malicious SVG, they can compromise subsequent users who view the file. The overall risk is therefore contingent on the protection of the API write privilege.