Tag

Extension-Bypass

1 brief RSS

Grav API Plugin File Upload Extension Bypass Leading to RCE

A vulnerability (CVE-2026-61457) in the Grav API plugin before version 1.0.3 allows an authenticated attacker with `api.media.write` permissions to bypass file upload extension validation using double extensions, which can lead to remote code execution on the web server.

Grav API plugin web-vulnerability remote-code-execution extension-bypass grav

1r 3t 1c 1h ago