CVE-2026-58654— Grav - Arbitrary File Upload via Avatar Endpoint
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Grav - Arbitrary File Upload via Avatar Endpoint
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual file content or restrict the resulting extension, allowing an authenticated user to store arbitrary content — including PHP code, SVG with embedded JavaScript, and polyglot payloads — under user/accounts/avatars/ with predictable filenames. Direct HTTP access to the stored files is blocked by .htaccess (returns 403), but the files persist on disk and could lead to remote code execution or stored XSS in the presence of a path traversal flaw or server misconfiguration. Fixed in 1.0.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
危险类型文件的不加限制上传
Source: NVD (National Vulnerability Database)
Vulnerability Title
Grav 任意文件上传漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grav Grav是Grav组织开源的一个基于文件系统的无数据库内容管理系统。 Grav 1.0.0版本存在任意文件上传漏洞，该漏洞源于在头像上传端点(/api/v1/users/user/avatar)中对文件上传验证不当，仅验证客户端声明的MIME类型开头为'image/'，未检查实际文件内容或限制扩展名，允许经过身份验证的用户存储任意内容，包括PHP代码、嵌有JavaScript的SVG和混合有效载荷，可能导致远程代码执行或存储型跨站脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58654
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-58654 (2)
- 🔗 Grav - Arbitrary File Upload via Avatar Endpoint | Advisories | VulnCheckthird-party-advisory
IV. Related Vulnerabilities
Same product: Grav
- CVE-2026-61454
Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ - CVE-2026-59193
Grav CMS — Improper Handling of Highly Compressed Data in In - CVE-2026-59190
Grav Admin Plugin — IDOR Privilege Escalation via saveUser() - CVE-2026-58493
grav-plugin-database: DSN Parameter Injection via Unsanitize - CVE-2026-58492
grav-plugin-database: SQL Injection in PDO::tableExists() du
Same vendor: Grav
- CVE-2026-58657
Grav - Stored CSS Injection via Markdown Image resize() Acti - CVE-2026-56700
Grav - Multiple Remote Code Execution Vulnerabilities via Un - CVE-2020-37256
Grav - Cross-Site Scripting in Admin Plugin Page Editor - CVE-2026-56701
Grav - XML External Entity Injection via SVG Upload - CVE-2026-11982
Stored XSS via missing XSS safety check in Admin2 Pages API
Same weakness: CWE-434
- CVE-2026-15488
hcr707305003 shiroiAdmin FileController.php upload unrestric - CVE-2026-61448
Parse Server 9.0.0 Stored XSS via malformed Content-Type - CVE-2026-57827
Joomla Extension - rsjoomla.com - Unauthenticated file uploa - CVE-2026-57828
Joomla Extension - phoca.cz - Authenticated file upload in R - CVE-2026-2354
Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbi
V. Comments for CVE-2026-58654
No comments yet