Grav API Plugin: Resource exhaustion and page permission bypass
Summary
The Grav API plugin (grav-plugin-api) for the Grav CMS contains two flaws. The public translations endpoint caches a full translation dictionary for every well-formed language code, and the sync and batch copy endpoints skip destination page rules. Unauthenticated attackers can send small requests that each store about 560 KB, exhausting disk space or the APCu cache and taking the site down. Accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
Affected
- grav-plugin-api 1.0.16 to before 1.0.42 (sync and batch copy checks)
- grav-plugin-api 1.0.40 to before 1.0.42 (translations cache)
Fixed in
- grav-plugin-api 1.0.42
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Not listed in CISA KEV; EPSS below 1%
- No public proof of concept found in the research; treat as unknown
Our recommendation
- Update grav-plugin-api to version 1.0.42 or later
- If the API plugin is not needed, disable it
- If it is needed, restrict access to /api at the reverse proxy or firewall to known networks
- Monitor disk usage and APCu cache growth
- Review accounts with api.pages.write and page-level rules
- Verify the installed version after the update
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8pcm-97fc-4xwh github.com
- VulnCheck advisory www.vulncheck.com
- OpenCVE CVE-2026-112779 app.opencve.io
- HOL Guard CVE-2026-112779 hol.org
- Grav API getting started (1.x docs) learn.getgrav.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:13.
Original description (NVD)
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.