https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T15:23:12.380829+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318007 EUVD-2026-318007 2026-10-10T15:23:12.383574+00:00 EUVD-2026-318007 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42844 fkie_cve-2026-42844 2026-10-10T15:23:12.383609+00:00

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

 https://cve.radiocsirt.org/vuln/ghsa-6xx2-m8wv-756h GHSA-6xx2-m8wv-756h — Low-privileged Grav API users can create super-admin accounts via blueprint-upload 2026-10-10T15:23:12.383642+00:00

Affected: Packagist: getgrav/grav

## Summary

In Grav `2.0.0-beta.2`, a low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` to write an arbitrary YAML file into `user/accounts/`, then log in as the newly created account with `api.super` privileges.

This results in full administrative compromise of the Grav API.

## Details

The vulnerability is located in the API plugin's blueprint upload flow:

- `user/plugins/api/classes/Api/ApiRouter.php:261` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:32-45` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:102-114` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:271-308` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:407-417` - `user/plugins/api/classes/Api/Controllers/AuthController.php:41-55`

The issue exists because `/api/v1/blueprint-upload` accepts caller-controlled `destination` and `scope` values and uses them to resolve the final filesystem write target.

When the request uses:

- `destination=self@:` - `scope=users/anything`

The server resolves the write target to the shared account directory:

```text user/accounts/ ```

The upload handler then writes the supplied file directly into that directory and does not block YAML account files. Because Grav accepts account YAML files and supports a plaintext `password:` field on first login, an attacker can create a fully functional administrator account with `api.s…