CVE-2026-58654: Grav - Arbitrary File Upload via Avatar Endpoint
The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content — including PHP code, SVG with embedded JavaScript, and polyglot payloads — under user/accounts/avatars/ with predictable filenames. Direct HTTP access to the stored files is blocked by .htaccess (returns 403), but the files persist on disk and could lead to remote code execution or stored XSS in the presence of a path traversal flaw or server misconfiguration. Fixed in 1.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.1 - Configuration
Modify the avatar upload endpoint validation to not rely solely on client-declared MIME type (getClientMediaType beginning with 'image/'); instead inspect the actual file content and restrict the resulting extension so only safe image formats are stored.
Grav avatar upload endpoint (/api/v1/users/user/avatar) via getgrav/grav-plugin-api file upload validation = inspect actual file content and restrict uploaded file types/extensions to images
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58654?
The severity of CVE-2026-58654 is medium, rated at 4.3.
How do I fix CVE-2026-58654?
To fix CVE-2026-58654, update to the latest version of the Grav API plugin that addresses the file upload vulnerability.
What type of vulnerability is CVE-2026-58654?
CVE-2026-58654 is categorized as an arbitrary file upload vulnerability.
What software is affected by CVE-2026-58654?
CVE-2026-58654 affects the Grav API plugin, specifically version 1.0.0.
What are the potential impacts of CVE-2026-58654?
The potential impacts of CVE-2026-58654 include security risks associated with malicious file uploads, such as exploitation through XSS or path traversal.