CVE-2026-61457 Details
Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.
A file upload extension bypass vulnerability has been identified in the Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.3. The issue resides in the API media controller, specifically within the HandlesMediaUploads::validateFileExtension() method, which only checks the final file extension. This flaw allows users with api.media.write permission to upload files with double extensions, such as shell.php.jpg, circumventing the blocklist of dangerous extensions. If the web server executes the file as PHP, this could lead to remote code execution.
Users are advised to update the Grav API plugin to version 1.0.3 or later, where this vulnerability has been patched. Additionally, implement stricter validation of file extensions by checking all components of the filename, not just the last extension, and verify the actual file content against its claimed MIME type to prevent the upload of executable files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-66v2-vxxf-xc3v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-66v2-vxxf-xc3v | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/grav-before-remote-code-execution-via-file-upload-extension-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav API | <= 1.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |