The Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.3 do not properly sanitize SVG files uploaded through the media API endpoint. The HandlesMediaUploads::processUploadedFile() method only validates the file extension and does not call Security::sanitizeSVG(), resulting in SVG files containing malicious JavaScript being stored and served unmodified with the Content-Type image/svg+xml. This allows an authenticated attacker with api.media.write permission to execute arbitrary scripts in the context of an administrator's browser session when the SVG is viewed, enabling cross-site scripting attacks.

An attacker with authenticated access and the api.media.write permission can upload malicious SVG files containing JavaScript. When an administrator views these SVG files, the embedded script executes in their browser session, potentially allowing cookie theft and session hijacking. This compromises the administrator's session security and may lead to further unauthorized actions within the Grav environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict api.media.write permissions to trusted users only and avoid opening SVG files uploaded via the API in administrator browsers. Monitor vendor communications for updates and apply official patches once released.