CVE-2026-58654

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.1

Description An unrestricted file upload issue exists in the avatar upload endpoint '/api/v1/users/user/avatar'. The system only validates the client-declared MIME type using getClientMediaType to check if it begins with 'image/', without inspecting actual file content or restricting extensions. This allows authenticated users to upload arbitrary content, such as PHP code, SVG files with embedded JavaScript, or polyglot payloads, to the 'user/accounts/avatars/' directory with predictable filenames. While .htaccess blocks direct HTTP access to these files, their persistence on disk could enable remote code execution or stored Cross-Site Scripting (XSS) if a path traversal flaw or server misconfiguration is present.

Recommendations Update to version 1.0.1.