Caching Vulnerabilities in Grav API Plugin by Grav

CVE-2026-112779

What is CVE-2026-112779?

The Grav API plugin versions 1.0.40 and earlier are vulnerable to issues that allow unauthenticated attackers to exploit the API. The plugin caches a complete translation dictionary for each language code provided in a GET request to the /api/v1/translations/{lang} endpoint, potentially leading to disk exhaustion. Additionally, versions 1.0.16 and earlier do not properly enforce permissions for sync and batch copy operations, allowing users with api.pages.write access to bypass page-level access restrictions, risking unauthorized content creation or modification.

References