Executive brief
The Grav API plugin, used to provide programmatic access to the Grav content management system, contains a security flaw in how it handles file uploads. An attacker with basic media upload permissions can bypass security filters by using double file extensions (such as 'file.php.jpg') to upload malicious scripts. If successful, this allows the attacker to execute arbitrary code on the server, potentially leading to a full system takeover or theft of sensitive data.
Technical details
A vulnerability exists in the HandlesMediaUploads::validateFileExtension() method of the Grav API plugin. The component uses pathinfo($filename, PATHINFO_EXTENSION) to validate uploads against a blocklist of dangerous extensions (e.g., .php, .phar). Because this function only inspects the final extension, an attacker with 'api.media.write' permissions can bypass the check using a double extension like 'shell.php.jpg'. Depending on the web server configuration, these files may be executed as PHP scripts. This leads to Remote Code Execution (RCE) or source code disclosure. The issue is addressed in version 1.0.3 by validating all components of a filename's extension.
Affected products
- getgrav Grav API plugin < 1.0.3
Timeline
- 2026-06-24: advisory: Vendor advisory published on GitHub
- 2026-07-15: disclosed: NVD publication date
- 2026-07-15: patched: Version 1.0.3 released to address the bypass