EUVD-2026-42265
GHSA-w3xr-jx24-vw2h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint (AV:N), low complexity upload (AC:L), requires authenticated low-privilege user (PR:L); integrity impact is Low given .htaccess blocking; no confidentiality or availability impact from the upload primitive alone.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content - including PHP code, SVG with embedded JavaScript, and polyglot payloads - under user/accounts/avatars/ with predictable filenames. Direct HTTP access to the stored files is blocked by .htaccess (returns 403), but the files persist on disk and could lead to remote code execution or stored XSS in the presence of a path traversal flaw or server misconfiguration. Fixed in 1.0.1.
AnalysisAI
Unrestricted file upload in Grav API Plugin 1.0.0 allows authenticated users to store arbitrary content - including PHP scripts, SVG with embedded JavaScript, and polyglot payloads - via the avatar upload endpoint by supplying a forged client-declared MIME type beginning with 'image/'. The endpoint performs no server-side content inspection and imposes no extension restriction, so malicious files are written to user/accounts/avatars/ with predictable filenames. Immediate exploitation is partially mitigated by an .htaccess rule that returns HTTP 403 on direct access, but the files persist on disk and represent a latent RCE or stored XSS vector if a co-resident path traversal flaw or server misconfiguration bypasses that control. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Grav is a PHP-based flat-file CMS; grav-plugin-api extends it with a RESTful API layer. The avatar upload handler at /api/v1/users/user/avatar relies exclusively on PHP's getClientMediaType() - a function that reads the Content-Type header supplied by the HTTP client - to gate file acceptance. Because this check is fully attacker-controlled and does not invoke server-side magic-byte inspection (e.g., finfo_file or getimagesize()), any file type can be submitted as long as the declared type starts with 'image/'. CWE-434 (Unrestricted Upload of File with Dangerous Type) precisely describes this root cause: the system trusts the client's self-reported MIME type rather than verifying actual file content. The stored path under user/accounts/avatars/ is predictable by convention, and filenames are derived from the username, making post-upload file location trivial to determine. The .htaccess defense is an Apache-specific control that fails silently under nginx, IIS, or any permissive Apache AllowOverride configuration.
RemediationAI
Upgrade grav-plugin-api to version 1.0.1, which is confirmed as the vendor-released fix per the GitHub security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-xc64-vh46-vph6 and the VulnCheck advisory at https://www.vulncheck.com/advisories/grav-arbitrary-file-upload-via-avatar-endpoint. If immediate upgrade is not possible, restrict access to the /api/v1/users/ endpoint via web server ACLs or a WAF rule requiring that only trusted IP ranges can reach avatar upload paths - note this blocks legitimate API consumers and must be coordinated with application owners. As an additional defensive layer, ensure the .htaccess file under user/accounts/avatars/ is enforced (Apache with AllowOverride All or AllowOverride FileInfo) and audit the web server type: if running nginx or IIS, the .htaccess protection is inert and the risk profile escalates significantly, making immediate patching mandatory. Periodic scanning of user/accounts/avatars/ for non-image file extensions (e.g., .php, .phtml, .svg containing script tags) can detect prior exploitation attempts.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today