Skip to content
Threat Feed
Subscribe

Product

Grav API Plugin (Getgrav/Grav-Plugin-Api) < 1.0.3

1 brief RSS
high advisory

Grav API Plugin File Upload Extension Bypass Leading to RCE

A vulnerability (CVE-2026-61457) in the Grav API plugin before version 1.0.3 allows an authenticated attacker with `api.media.write` permissions to bypass file upload extension validation using double extensions, which can lead to remote code execution on the web server.

Grav API plugin web-vulnerability remote-code-execution extension-bypass grav
1r 3t 1c