https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:09:53.228434+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335630 EUVD-2026-335630 2026-10-09T02:09:53.276976+00:00 EUVD-2026-335630 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61456 fkie_cve-2026-61456 2026-10-09T02:09:53.277032+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.

 https://cve.radiocsirt.org/vuln/ghsa-g78v-pr5g-35v2 GHSA-g78v-pr5g-35v2 2026-10-09T02:09:53.277086+00:00

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.