CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.3 is vulnerable due to a file upload extension bypass in its media controller, allowing users with api.media.write permissions to upload files with deceptive double extensions (e.g., shell.php.jpg). This flaw can lead to remote code execution if the web server processes the file as PHP. Organizations using this plugin should prioritize patching to mitigate the risk of unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions blocklist. The web server may then execute the file as PHP, resulting in remote code execution.