The Grav plugin-api prior to version 1.0.15 contains a script injection vulnerability due to improper input neutralization during web page generation. Specifically, the SVG sanitizer only checks for the '.svg' file extension, which allows files with '.svgz' and '.xhtml' extensions to bypass sanitization. This enables attackers who have api.media.write permissions to upload files with embedded executable script payloads. When these files are accessed by administrators or visitors, the scripts execute within the site's origin context, leading to potential cross-site scripting attacks.

Successful exploitation allows attackers with limited write permissions to upload malicious files that execute scripts in the context of the vulnerable site. This can lead to unauthorized script execution affecting administrators and visitors, potentially resulting in session hijacking, defacement, or other client-side attacks. The CVSS score of 5.1 reflects a medium severity with network attack vector, low complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict api.media.write permissions to trusted users only and monitor uploads for suspicious file types. Avoid accessing or rendering untrusted SVGZ or XHTML files within the site origin.