The Grav API plugin (getgrav/grav-plugin-api) versions prior to 1.0.3 contain a file upload extension bypass vulnerability in the API media controller. The function HandlesMediaUploads::validateFileExtension() only checks the final file extension using pathinfo, which allows an attacker with api.media.write permission to upload files with double extensions that evade the dangerous extensions blocklist. If the web server processes the uploaded file as PHP, this can result in remote code execution.

An attacker with api.media.write permission can upload malicious files with double extensions that bypass extension checks. This may lead to remote code execution on the affected system if the web server executes the uploaded file as PHP code. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict api.media.write permissions to trusted users only and consider additional server-side controls to prevent execution of uploaded files with suspicious extensions.