The Grav API plugin contains a flaw in the file upload validation logic that only checks the final extension, allowing a user with api.media.write permission to upload a file with a double extension such as shell.php.jpg. Because the blocklist of disallowed extensions is bypassed, the web server can execute the uploaded file as PHP, resulting in remote code execution. This flaw is categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type).

The vulnerability is present in Grav CMS versions earlier than 1.0.3, specifically within the getgrav/grav-plugin-api media controller. Any site running a pre-1.0.3 Grav installation that permits API media uploads is susceptible to this issue.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the API endpoint that handles media uploads; based on the description, it is inferred that an authenticated user with api.media.write rights can exploit the flaw by uploading a double‑extension file. If successful, the attacker can place executable PHP scripts in the media directory, giving full remote code execution on the host.