Grav API Plugin CVE-2026-61457

Exploitation requires two explicit prerequisites: first, the attacker must be authenticated to the Grav API with the api.media.write permission explicitly granted - this is not a default open permission and must be assigned by an administrator; second, the web server must be configured to execute PHP in files where .php appears anywhere in the filename (e.g., Apache AddHandler application/x-httpd-php .php or equivalent mod_php/php-fpm directives that do not restrict to the final extension). Without the web server execution condition, the file is stored but cannot be triggered as code. Exploitation does not require any additional network position, special timing, or user interaction beyond the authenticated upload request. The limiting factors - non-default api.media.write permission assignment and web server PHP multi-extension handling - meaningfully constrain the realistic attacker population compared to the raw network-accessible attack vector.

The official CVSS 4.0 score of 5.3 reflects the PR:L constraint (authenticated access with a specific write permission required) and the conservative impact metrics (VC:L/VI:L), but the RCE tag in the intelligence data suggests the downstream impact can exceed what the score implies if the web server executes multi-extension PHP files. The real-world risk is therefore bifurcated: for installations that both expose the API plugin and run Apache (or equivalent) with AddHandler-style PHP execution on upload directories, this is a meaningful RCE vector for any API user with media write access. For installations where the upload directory is not PHP-executable - or where api.media.write is tightly controlled - exploitation is either blocked or limited to privileged insiders. No EPSS score was provided in the input data. No KEV listing exists, and no confirmed public exploit code is known at time of analysis, meaning active exploitation has not been broadly observed. CVSS signals network accessibility and low attack complexity, making this a priority patch for affected deployments rather than a deferred low-urgency item.

An attacker who holds or has compromised a Grav API account with api.media.write permission sends a multipart file upload request to the API media endpoint with the filename shell.php.jpg. The validateFileExtension() check passes because pathinfo() returns jpg. If the server runs Apache with a global AddHandler for .php files, a subsequent HTTP GET request to the stored file triggers PHP interpretation, executing attacker-controlled code as the web server process user. No public exploit code has been identified at time of analysis, but the technique is a well-known bypass class with no mitigating complexity.