Live › vulnerability › CVE-2026-112779
Go to dashboardThe Grav API plugin caches a full translation dictionary for every language code sent to an unauthenticated endpoint, so small requests can fill disk or APCu memory. Accounts with page-write permission can also copy or overwrite pages that page-level rules should deny.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| grav-plugin-api | composer | >= 1.0.16, < 1.0.42 | 1.0.42 |
bin/gpm index or Admin > Plugins1.0.40-1.0.41 (anonymous translations cache, GET /api/v1/translations/{lang}); 1.0.16-1.0.41 (sync and batch copy skip page rules, needs api.pages.write)1.0.42 (e.g. bin/gpm update api)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.
This page as .md · .json · in your agent: get_signal("CVE-2026-112779")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.