PT-2026-60148 · Getgrav · Grav

Alienkeric · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-61457

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-61457

Produtos afetados

Grav

Referências · 3

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-66v2-vxxf-xc3v · Exploit
• https://vulncheck.com/advisories/grav-before-remote-code-execution-via-file-upload-extension-bypass · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-61457 · Nota de Segurança