CVE-2026-61457

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.3

Description A file upload extension bypass exists in the API media controller. The function validateFileExtension() only inspects the final file extension using pathinfo($filename, PATHINFO EXTENSION), allowing a user with api.media.write permission to upload files with double extensions, such as shell.php.jpg, to bypass the blocklist of dangerous extensions. This can lead to remote code execution if the web server executes the uploaded file as PHP.

Recommendations Update Grav API plugin to version 1.0.3 or later.