Read the docs
TI-2026-42219 Aliases CVE-2026-58654GHSA-w3xr-jx24-vw2h

Grav - Arbitrary File Upload via Avatar Endpoint

Priority MEDIUM 57CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content — including PHP code, SVG with embedded JavaScript, and polyglot payloads — under user/accounts/avatars/ with predictable filenames. Direct HTTP access to the stored files is blocked by .htaccess (returns 403), but the files persist on disk and could lead to remote code execution or stored XSS in the presence of a path traversal flaw or server misconfiguration. Fixed in 1.0.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed Grav (Grav): 1.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GravGravbefore 1.0.11.0.1Patch availableCNA
  • Grav VendorGrav Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA

Remediation

  • Fix · CNA Grav (Grav) Fixed in 1.0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58654
  2. 2026-10-03 Alias added: GHSA-w3xr-jx24-vw2h

References

Advisory 1

  • TI-2026-40880 Grav - XML External Entity Injection via SVG Upload CVSS 4.0HIGH 7.1
  • TI-2026-10325 Stored XSS via missing XSS safety check in Admin2 Pages API partial validation CVSS 4.0MEDIUM 5.1
  • TI-2026-42222 Grav - Stored CSS Injection via Markdown Image resize() Action CVSS 4.0MEDIUM 4.8
  • TI-2026-40879 Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-06424 Grav CMS Cache Value FileCache.php doGet deserialization CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences