CVE-2026-74908CWE-79cross-site-scripting

CVE-2026-74908

Medium · published August 18, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-18T16:19Z
References (2)
https://github.com/getgrav/grav/security/advisories/GHSA-66xf-ggf4-6hmc · [email protected]https://www.vulncheck.com/advisories/grav-plugin-api-before-script-injection-via-svg · [email protected]
EPSS history
Timeline
  • 18 AUG 11:19Z
    Grav plugin-api before 1.0.15 Script Injection via SVG
    cvelistv5