Is there a patch available for CVE-2026-61457?

Yes, a patch is available for CVE-2026-61457. Update the affected software to the latest version immediately.

Grav API Plugin CVE-2026-61457

Q: What is the CVSS score of CVE-2026-61457?

CVE-2026-61457 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-44651 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-15 VulnCheck

GHSA-7wcr-m737-mchr

PHP RCE File Upload Grav Getgrav

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-accessible upload requires only api.media.write privilege; scope changes because PHP execution extends impact to OS level beyond the application.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 13:03 EUVD

Analysis Generated

Jul 15, 2026 - 12:35 vuln.today

DescriptionCVE.org

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.

AnalysisAI

Remote code execution in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is achievable by authenticated API users holding the api.media.write permission via a double-extension file upload bypass. The HandlesMediaUploads::validateFileExtension() method uses PHP's pathinfo() to inspect only the final file extension, meaning a file named shell.php.jpg passes the dangerous-extension blocklist while retaining a .php segment that certain web server configurations will execute as PHP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and exploitation is low-complexity once permission prerequisites are met.

Technical ContextAI

The vulnerability is rooted in CWE-434 (Unrestricted Upload of File with Dangerous Type) within the Grav flat-file CMS API plugin. The specific flaw is in HandlesMediaUploads::validateFileExtension(), which calls PHP's pathinfo($filename, PATHINFO_EXTENSION) - a function that returns only the substring after the final dot. A filename like shell.php.jpg therefore returns jpg, which is not on the blocklist, allowing the upload to proceed. The danger is realized when the web server is configured to treat any file whose name contains .php as executable PHP (a behavior historically common with Apache mod_php AddHandler directives). Affected software is identified by CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* covering all Grav installations with the API plugin prior to version 1.0.3. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation requiring low privilege and no user interaction.

RemediationAI

Upgrade the Grav API plugin to version 1.0.3 or later, which resolves the double-extension bypass by implementing more thorough filename validation. The fix is confirmed by the CVE description specifying 'before 1.0.3' as the affected range. Consult the vendor advisory at https://github.com/getgrav/grav/security/advisories/GHSA-66v2-vxxf-xc3v for upgrade instructions. If immediate upgrade is not feasible, revoke api.media.write permissions from all non-essential API accounts - note this will disable legitimate API-driven media uploads as a side effect. As a defence-in-depth measure independent of the plugin fix, configure the web server to disable PHP execution within the Grav media/user upload directory (e.g., Apache: place a .htaccess with 'php_flag engine off' or a Directory block with 'RemoveHandler .php' in the uploads path); this prevents execution of uploaded files even if bypass is achieved, though it does not fix the underlying flaw.