CyberRota Analysis
AI-GeneratedThe Grav API plugin version 1.0.0 is vulnerable due to an unrestricted file upload flaw in the avatar upload endpoint, allowing authenticated users to upload arbitrary files, including potentially malicious code. While direct access to these files is restricted, the persistence of these files on disk poses a risk of remote code execution or stored XSS if combined with a path traversal vulnerability or server misconfiguration. Organizations using this plugin should prioritize upgrading to version 1.0.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content — including PHP code, SVG with embedded JavaScript, and polyglot payloads — under user/accounts/avatars/ with predictable filenames. Direct HTTP access to the stored files is blocked by .htaccess (returns 403), but the files persist on disk and could lead to remote code execution or stored XSS in the presence of a path traversal flaw or server misconfiguration. Fixed in 1.0.1.