Executive brief
The Grav API plugin, which provides programmatic access to the Grav content management system, contains a security flaw in how it handles user profile picture uploads. An authenticated user can upload malicious files, such as web shells or scripts, because the system only checks the file type claimed by the user rather than the actual content. While these files are currently blocked from direct access by default security rules, they remain on the server and could be used to take over the system if combined with other server configuration issues.
Technical details
An unrestricted file upload vulnerability exists in the `/api/v1/users/user/avatar` endpoint of the Grav API plugin version 1.0.0. The `UsersController` validates only the client-provided `Content-Type` header (checking if it starts with 'image/') using `getClientMediaType()` without verifying the actual file signatures or content. This allows authenticated attackers to upload PHP scripts, SVG files with embedded JavaScript, or polyglot payloads which are then stored in the `user/accounts/avatars/` directory with predictable filenames. Although direct HTTP access is currently restricted by `.htaccess` rules, the presence of these files on disk creates a significant risk of Remote Code Execution (RCE) or stored Cross-Site Scripting (XSS) if bypassed via path traversal or server misconfiguration. The issue is fixed in version 1.0.1.
Affected products
- Grav Grav API plugin (grav-plugin-api) 1.0.0
Timeline
- 2026-06-22: advisory: GitHub Security Advisory GHSA-xc64-vh46-vph6 published
- 2026-07-08: disclosed: CVE-2026-58654 published to NVD