CVE-2026-61457: Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFOEXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61457?
The severity of CVE-2026-61457 is rated as medium with a score of 5.3.
What kind of vulnerability is CVE-2026-61457?
CVE-2026-61457 is a remote code execution vulnerability resulting from a file upload extension bypass.
How do I fix CVE-2026-61457?
To fix CVE-2026-61457, update to Grav API plugin version 1.0.3 or later.
What software is affected by CVE-2026-61457?
CVE-2026-61457 affects the Grav API plugin (getgrav/grav-plugin-api) versions before 1.0.3.
What is the impact of CVE-2026-61457?
The impact of CVE-2026-61457 includes potential remote code execution due to malicious file uploads.