VULNERABILITY INTELLIGENCE

CVE-2026-58654

CVSS score5.3 MEDIUM

EPSS probability0.44%

CISA KEVNot currently listed

Published2026-07-08

Last modified2026-07-08

Description

The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted file upload vulnerability in the avatar upload endpoint (/api/v1/users/user/avatar). The endpoint validates only the client-declared MIME type (getClientMediaType) beginning with 'image/' and does not inspect the actual fil…