PT-2026-60148 · Getgrav · Grav

Alienkeric · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-61457

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-61457

Affected Products

Grav

References · 3

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-66v2-vxxf-xc3v · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61457 · Security Note
• https://vulncheck.com/advisories/grav-before-remote-code-execution-via-file-upload-extension-bypass · Note