CVE WatchJul 15, 2026

CVE-2026-61457

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMedia

CVSS

8.8

High

EPSS

0.5%

p37

KEV

—

Exploit Today

0-100

Published: Jul 15, 2026 · Last modified: Jul 15, 2026 · CWE-434

EPSS · 30d

0.5%EPSS · 30 days0.5%

2026-07-162026-07-17

Technical description

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-562909.8 CRI

85.4%

KEV—76Joomlack Page Builder Improper Access Control Vulnerability10d CVE-2026-489089.8 CRI

72.6%

KEV—72JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability10d CVE-2026-489399.8 CRI

71.5%

KEV—71iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability7d CVE-2026-562919.8 CRI

53.7%

KEV—66Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability7d CVE-2023-388368.8 HIG

99.3%

——30File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.10d CVE-2023-464747.2 HIG

97.3%

——29File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.10d