What is GHSA-88pj-3rjg-jjc5?

GHSA-88pj-3rjg-jjc5 is a security advisory published by GitHub Security Advisories with Medium severity. Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer...

Which CVE IDs does GHSA-88pj-3rjg-jjc5 cover?

GHSA-88pj-3rjg-jjc5 covers the following CVE IDs: CVE-2026-74908. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-88pj-3rjg-jjc5?

GHSA-88pj-3rjg-jjc5 has a CVSS v3 base score of 4.6, published by GitHub Security Advisories.

GHSA-88pj-3rjg-jjc5MediumCVSS 4.6

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer...

Vendor

GitHub Security Advisories

Published

August 18, 2026

Last Modified

August 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-74908 →

📋 Description

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing executable script payloads that execute in the site origin when accessed by administrators or visitors.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-66xf-ggf4-6hmc
https://nvd.nist.gov/vuln/detail/CVE-2026-74908
https://www.vulncheck.com/advisories/grav-plugin-api-before-script-injection-via-svg
https://github.com/advisories/GHSA-88pj-3rjg-jjc5