CVE-2026-42844

Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h	Exploit Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:getgrav:grav:2.0.0:beta2:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Grav es una plataforma web basada en archivos. En Grav 2.0.0-beta.2, un usuario de API autenticado con privilegios bajos y con api.media.write puede abusar de /api/v1/blueprint-upload para escribir un archivo YAML arbitrario en user/accounts/, y luego iniciar sesión como la cuenta recién creada con privilegios api.super. Esto resulta en un compromiso administrativo total de la API de Grav. Esta vulnerabilidad se corrige en la API 1.0.0-beta.17.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-42844

Mitre link : CVE-2026-42844

CVE.ORG link : CVE-2026-42844

JSON object : View

Products Affected

getgrav

grav

CWE

CWE-269

Improper Privilege Management

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-42844", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42844", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T14:28:07.384843Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "2.0.0-beta.2"}]}]}], "published": "2026-05-12T22:16:34.793", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-6xx2-m8wv-756h", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user with api.media.write can abuse /api/v1/blueprint-upload to write an arbitrary YAML file into user/accounts/, then log in as the newly created account with api.super privileges. This results in full administrative compromise of the Grav API. This vulnerability is fixed in API 1.0.0-beta.17."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. En Grav 2.0.0-beta.2, un usuario de API autenticado con privilegios bajos y con api.media.write puede abusar de /api/v1/blueprint-upload para escribir un archivo YAML arbitrario en user/accounts/, y luego iniciar sesi\u00f3n como la cuenta reci\u00e9n creada con privilegios api.super. Esto resulta en un compromiso administrativo total de la API de Grav. Esta vulnerabilidad se corrige en la API 1.0.0-beta.17."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getgrav:grav:2.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23F8F687-3238-4CC0-AAC0-8D73DD13EB57"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}