Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-api

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-109320

    Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

    The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already author…

    getgrav grav-plugin-api
  • Medium 4.6
    CVE-2026-61607

    Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer

    Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does…

    getgrav grav-plugin-api