The Grav API plugin’s media upload endpoint validates the file extension for SVG uploads but fails to invoke the sanitization routine, allowing an attacker with api.media.write permission to upload an SVG containing embedded JavaScript. When a victim opens the uploaded file, the server serves it with a Content‑Type header of image/svg+xml, causing the browser to execute the script in the context of the site. The malicious code can read the viewer’s session cookie and perform authenticated actions on their behalf, effectively enabling session hijacking and privilege escalation within the site’s scope.

All releases of the Grav API plugin for Grav CMS prior to version 1.0.2 are affected. The plugin is distributed by getgrav under the product name grav‑plugin‑api and is accessed via the RESTful API endpoint POST /api/v1/media.

The CVSS score of 4.6 indicates a medium severity vulnerability. EPSS data shows a score of 0.00208, indicating a very low but non‑zero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation requires possession of api.media.write permission, a privilege normally granted only to trusted users or administrators; however, once such a user uploads a malicious SVG, any subsequent user who opens the file can be compromised. The overall risk depends on how the API write permission is controlled and how often SVG uploads are employed.