Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112779— Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

Quick assessment

Affected
getgrav grav-plugin-api
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grav API 插件（grav-plugin-api）在 1.0.40 至 1.0.41 版本中，会对发送至未身份验证的 端点的任何有效语言代码，缓存完整的翻译字典；而 1.0.16 至 1.0.41 版本在同步（sync）和批量复制（batch copy）端点中未能检查目标页面与目的页面的访问规则。未身份验证的攻击者可以发送小型请求，每个请求约占用 560 KB 的存储空间，从而耗尽磁盘空间或 APCu 缓存；同时，拥有 权限的账户可以覆盖翻译内容，或创建被页面级规则明确禁止的页面。

CVSS 9.8 · Critical

Affected Version Matrix 2

VendorProduct Version RangeStatus
getgrav grav-plugin-api 1.0.16< 1.0.42 affected
1.0.42 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112779

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getgrav grav-plugin-api 1.0.16 ~ 1.0.42 -

II. Public POCs for CVE-2026-112779

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112779

请登录查看更多情报信息。

Other References for CVE-2026-112779 (2)

Same Patch Batch · getgrav · 2026-10-19 · 4 CVEs total

CVE-2026-112780 8.8 HIGH Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
CVE-2026-112782 7.5 HIGH Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
CVE-2026-112781 6.5 MEDIUM Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

IV. Related Vulnerabilities

Same product: grav-plugin-api
Same vendor: getgrav
Same weakness: CWE-770

V. Comments for CVE-2026-112779

No comments yet

Leave a comment