CVE-2026-58654: Grav API Plugin Avatar Upload File Validation Bypass

Technical summary

CVE-2026-58654 is an unrestricted file upload vulnerability in the Grav API plugin's avatar upload endpoint (/api/v1/users/user/avatar). The vulnerability stems from insufficient validation: the endpoint checks only the client-provided MIME type via getClientMediaType() for an 'image/' prefix but performs no content inspection and does not enforce file extension restrictions. Authenticated users can upload arbitrary files — including PHP executables, polyglot payloads, and SVGs with embedded JavaScript — which are stored under user/accounts/avatars/ with predictable filenames. While .htaccess rules prevent direct HTTP access (HTTP 403), the files persist on disk. The risk of remote code execution or stored XSS escalates if the deployment has path traversal vulnerabilities, misconfigured web server rules, or alternative access mechanisms. The issue was corrected in version 1.0.1.

Business impact

Organizations using the Grav API plugin 1.0.0 face a moderate but real risk to data integrity and system security. If an attacker with user credentials uploads malicious files, they could potentially execute code on the server or inject malicious scripts that execute when content is served. The attack requires prior authentication, limiting the immediate blast radius, but accounts can be compromised through credential theft, insider threats, or supply-chain attacks. The predictable storage locations and persistence of files on disk mean that exploitation windows can extend over time. Reputational and compliance risks arise if the vulnerability enables data exfiltration or service disruption.

Affected systems

All deployments running Grav API plugin version 1.0.0 are affected. The vulnerability does not exist in version 1.0.1 or later. Deployments are at highest risk if they involve multi-user environments, expose the API endpoint to untrusted users, or run on servers with additional misconfigurations that could bypass the .htaccess protections or expose the avatars directory via alternative paths.

Exploitability

Exploitability is moderate. The attack requires authentication — an attacker must have valid user credentials or be able to create a user account — but does not require elevated privileges. Once authenticated, uploading a malicious file is trivial: a simple HTTP POST with a falsified 'image/' MIME type succeeds. However, triggering code execution or stored XSS depends on auxiliary weaknesses: path traversal bugs, server misconfigurations, PHP execution in the avatars directory, or other means to access or interpret the uploaded files outside the .htaccess-protected direct HTTP path. The CVSS score of 4.3 reflects the authentication requirement and the indirect nature of impact.

Remediation

Upgrade to Grav API plugin version 1.0.1 or later immediately. Version 1.0.1 implements proper file content validation and enforces file extension restrictions, closing the upload bypass. After upgrading, review the avatars directory (user/accounts/avatars/) to identify and remove any suspicious files uploaded before the patch was applied. Verify that .htaccess rules are in place and functional. Consider implementing additional controls: restrict avatar uploads to whitelisted extensions (e.g., .jpg, .png), use randomized filenames instead of predictable ones, store uploads outside the web root, and apply the principle of least privilege to API endpoints.

Patch guidance

Update the Grav API plugin from version 1.0.0 to 1.0.1 or any later release. Verify against the official Grav plugin repository or vendor advisory to confirm version numbers and download integrity. If automatic updates are unavailable, manually download and install version 1.0.1 from the official source, then restart the application. After patching, audit the avatars directory for any suspicious files created during the window the vulnerable version was active. Test the avatar upload functionality to ensure the patch does not break legitimate workflows.

Detection guidance

Monitor for suspicious file uploads to the /api/v1/users/user/avatar endpoint, particularly those with mismatched MIME types or binary patterns inconsistent with valid images. Check the user/accounts/avatars/ directory for files with unusual extensions (e.g., .php, .svg, .exe) or unexpected content. Review authentication logs for compromised accounts or anomalous login activity. Examine web server logs for POST requests to the avatar endpoint and correlate with subsequent attempts to access the avatars directory via direct paths or traversal patterns. If PHP execution is possible in the avatars directory, monitor for unusual process spawning or outbound connections from the web server process.

Why prioritize this

This vulnerability merits prompt attention despite its moderate CVSS score (4.3). The combination of a predictable attack surface (authenticated file upload), persistent storage of malicious payloads, and potential for code execution or stored XSS creates a meaningful risk in multi-user environments. The authentication requirement and lack of active exploitation (not in CISA KEV) place it below critical level, but the ease of exploitation and the persistence of uploaded files warrant prioritization above typical 4.x-scored issues. Organizations should patch within their standard update windows, typically one to two weeks.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects the following: the vulnerability is network-accessible with low attack complexity, but requires user privileges (authentication). The impact on integrity is low (ability to modify or inject content), with no direct impact on confidentiality or availability. The authentication requirement and the mitigating effect of .htaccess rules prevent a higher score. However, this static score does not fully capture the risk in environments with server misconfigurations, path traversal vulnerabilities, or PHP execution in the avatars directory, where impact could escalate.

Frequently asked questions