CVE-2026-61457: Grav API Plugin File Upload RCE Flaw

CVE-2026-61457 Overview

CVE-2026-61457 affects the Grav API plugin (getgrav/grav-plugin-api) in versions before 1.0.3. The plugin's media controller contains a file upload extension bypass that permits authenticated users with api.media.write permission to upload PHP files disguised with double extensions. The HandlesMediaUploads::validateFileExtension() function inspects only the final file extension, allowing filenames such as shell.php.jpg to bypass the dangerous extensions blocklist. When the web server processes the uploaded file as PHP, remote code execution follows. The weakness is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
An attacker holding api.media.write permission can achieve remote code execution on the Grav host by uploading a file with a crafted double extension.

Affected Products

Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.3
Grav CMS installations with the vulnerable API plugin enabled
Deployments where the web server executes PHP based on filename patterns

Discovery Timeline

2026-07-15 - CVE-2026-61457 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61457

Vulnerability Analysis

The Grav API plugin exposes a media upload endpoint protected by the api.media.write permission. Before writing an uploaded file to disk, the controller calls HandlesMediaUploads::validateFileExtension() to reject dangerous types such as .php, .phtml, or .phar.

The validator extracts the extension using pathinfo($filename, PATHINFO_EXTENSION), which returns only the substring after the final period. A filename such as shell.php.jpg returns jpg, which passes the blocklist. The file is then written to the media directory with the double extension preserved.

Many Apache configurations using AddHandler or AddType directives associate the .php extension with the PHP handler regardless of position in the filename. The web server then executes shell.php.jpg as PHP, allowing the attacker's payload to run in the context of the web server user.

Root Cause

The root cause is incomplete input validation in HandlesMediaUploads::validateFileExtension(). The function relies solely on the terminal extension returned by pathinfo() and does not enumerate every dotted segment in the filename. This mismatch between the validation logic and the web server's file handler resolution creates the bypass.

Attack Vector

Exploitation requires network access to the API endpoint and an authenticated account with api.media.write permission. The attacker crafts a multipart upload request whose filename contains an intermediate .php segment followed by a whitelisted image or document extension. After the file lands in the media directory, the attacker requests its public URL. If the web server maps intermediate .php segments to the PHP interpreter, the payload executes and returns command output over HTTP.

The vulnerability is described in prose only because no public proof-of-concept code is included in the enriched data. Refer to the GitHub Security Advisory GHSA-66v2-vxxf-xc3v and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-61457

Indicators of Compromise

Files in Grav user/pages/ or media directories with double extensions such as .php.jpg, .php.png, .phtml.gif, or .phar.pdf.
API access logs showing POST or PUT requests to media upload endpoints from accounts with api.media.write permission.
Web server access logs showing GET requests to uploaded media assets that return dynamic content rather than static bytes.
New or unexpected outbound network connections originating from the PHP-FPM or Apache process user.

Detection Strategies

Scan the Grav filesystem recursively for filenames matching the regex \.(php|phtml|phar|pht|php[3-8])\..+$.
Compare API request bodies against the media directory listing to identify uploads whose filenames contain executable extensions.
Alert on any PHP process spawned as a child of the web server whose working directory resides under a media or user upload path.

Monitoring Recommendations

Forward Grav application logs and web server access logs to a centralized log platform and retain them long enough to support retrospective hunts.
Monitor authentication events on the Grav admin and API interfaces for anomalous logins or newly created accounts granted api.media.write.
Track file integrity for the Grav installation directory and alert on newly created files with compound extensions.

How to Mitigate CVE-2026-61457

Immediate Actions Required

Upgrade the Grav API plugin to version 1.0.3 or later on all Grav instances.
Audit user accounts and API tokens for the api.media.write permission and revoke access that is not strictly required.
Inspect media directories for files with double extensions and quarantine any matches for forensic review.
Rotate credentials and API tokens if unauthorized uploads are found.

Patch Information

Grav has released version 1.0.3 of the API plugin, which corrects HandlesMediaUploads::validateFileExtension() so that every dotted segment of the filename is checked against the dangerous extensions blocklist. Details are published in the GitHub Security Advisory GHSA-66v2-vxxf-xc3v.

Workarounds

Temporarily disable the Grav API plugin until the patched version is deployed.
Configure the web server to execute PHP only when the filename ends exactly in .php by replacing AddHandler/AddType directives with a <FilesMatch "\.php$"> block.
Deny direct web access to the Grav media and user upload directories, serving files through a controller that sets a static Content-Type.
Enforce server-side content type validation on the storage layer to reject files whose contents contain PHP tags.

bash

# Apache configuration example restricting PHP execution to exact .php suffix
<FilesMatch "\.php$">
    SetHandler application/x-httpd-php
</FilesMatch>

# Block execution of any file inside the Grav user uploads directory
<Directory "/var/www/grav/user/pages">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar|pht)\.">
        Require all denied
    </FilesMatch>
</Directory>