Medium severity4.6NVD Advisory· Published Aug 18, 2026

CVE-2026-74908

Description

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Getgrav/Grav Plugin APIllm-fuzzy
Range: <1.0.15
Getgrav/Gravllm-fuzzy
Range: <1.0.15

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-66xf-ggf4-6hmcnvd
www.vulncheck.com/advisories/grav-plugin-api-before-script-injection-via-svgnvd

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000