CyberRota Analysis
AI-GeneratedThe Grav plugin-api prior to version 1.0.15 is vulnerable to a script injection flaw due to inadequate sanitization of uploaded files, allowing .svgz and .xhtml files to bypass checks. This could enable attackers with api.media.write permissions to upload malicious scripts that execute in the context of the site, potentially compromising the integrity of the site for both administrators and visitors. Website administrators and developers using this plugin should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.