File Upload Extension Bypass in Grav API Plugin by Grav

CVE-2026-61457

What is CVE-2026-61457?

The Grav API plugin prior to version 1.0.3 has a critical flaw in its media upload handling. It allows attackers with the proper permissions to bypass file extension restrictions. By manipulating file names to include double extensions (e.g., 'shell.php.jpg'), malicious users can upload potentially dangerous files that may be executed by the web server, leading to unauthorized code execution and exploitation of the affected server.

References