https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 15:23:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318007 EUVD-2026-318007 https://cve.radiocsirt.org/vuln/euvd-2026-318007 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42844 <p>Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.</p> <p>Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42844 https://cve.radiocsirt.org/vuln/ghsa-6xx2-m8wv-756h <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>In Grav `2.0.0-beta.2`, a low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` to write an arbitrary YAML file into `user/accounts/`, then log in as the newly created account with `api.super` privileges.</p> <p>This results in full administrative compromise of the Grav API.</p> <p>## Details</p> <p>The vulnerability is located in the API plugin&#39;s blueprint upload flow:</p> <p>- `user/plugins/api/classes/Api/ApiRouter.php:261` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:32-45` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:102-114` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:271-308` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:407-417` - `user/plugins/api/classes/Api/Controllers/AuthController.php:41-55`</p> <p>The issue exists because `/api/v1/blueprint-upload` accepts caller-controlled `destination` and `scope` values and uses them to resolve the final filesystem write target.</p> <p>When the request uses:</p> <p>- `destination=self@:` - `scope=users/anything`</p> <p>The server resolves the write target to the shared account directory:</p> <p>```text user/accounts/ ```</p> <p>The upload handler then writes the supplied file directly into that directory and does not block YAML account files. Because Grav accepts account YAML files and supports a plaintext `password:` field on first login, an attacker can create a fully functional administrator account with `api.s…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>In Grav `2.0.0-beta.2`, a low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` to write an arbitrary YAML file into `user/accounts/`, then log in as the newly created account with `api.super` privileges.</p> <p>This results in full administrative compromise of the Grav API.</p> <p>## Details</p> <p>The vulnerability is located in the API plugin&#39;s blueprint upload flow:</p> <p>- `user/plugins/api/classes/Api/ApiRouter.php:261` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:32-45` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:102-114` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:271-308` - `user/plugins/api/classes/Api/Controllers/BlueprintUploadController.php:407-417` - `user/plugins/api/classes/Api/Controllers/AuthController.php:41-55`</p> <p>The issue exists because `/api/v1/blueprint-upload` accepts caller-controlled `destination` and `scope` values and uses them to resolve the final filesystem write target.</p> <p>When the request uses:</p> <p>- `destination=self@:` - `scope=users/anything`</p> <p>The server resolves the write target to the shared account directory:</p> <p>```text user/accounts/ ```</p> <p>The upload handler then writes the supplied file directly into that directory and does not block YAML account files. Because Grav accepts account YAML files and supports a plaintext `password:` field on first login, an attacker can create a fully functional administrator account with `api.s…</p> https://cve.radiocsirt.org/vuln/ghsa-6xx2-m8wv-756h