Loading story…
Apache disclosed CVE-2026-41041, a low-severity vulnerability in Apache Gravitino caused by unencoded user-supplied identifiers in MCP REST client f-string URL construction. The flaw allows URL path injection that can lead to path traversal and access to unintended API endpoints, potentially altering how requests are routed within affected deployments.
The issue affects Apache Gravitino versions 1.0.0 through 1.2.0, with the fix released in version 1.2.1. The vulnerability was published through Apache and oss-security advisories, and users were urged to upgrade to Apache Gravitino 1.2.1 to remediate the issue.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-13, Apache disclosed CVE-2026-41041, a low-severity URL path injection vulnerability in Apache Gravitino. The flaw can allow path traversal to unintended API endpoints via unencoded user-supplied identifiers in MCP REST client URL construction.
Apache Gravitino version 1.2.1 was identified as the release that fixes a URL path injection flaw caused by unencoded user-supplied identifiers in MCP REST client f-string URL construction. The vulnerability affects versions 1.0.0 through versions before 1.2.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcelists.apache.org
Open sourceopenwall.com
Open sourcecve.org
Open sourcegravitino.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A mass disclosure detailed **11 vulnerabilities** in **Grav CMS** and the **`getgrav/grav-plugin-api`** package, with the most severe issues affecting the API plugin before **`1.0.13`** and Grav CMS before **`2.0.13`**. Multiple API endpoints failed to enforce API key scope caps or relied on bare `isSuperAdmin()` checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (`CVE-2026-72826`), promoting users or invited accounts to super-admin (`CVE-2026-72828`, `CVE-2026-72829`, `CVE-2026-72833`), and disabling 2FA for non-super accounts without a TOTP code via `POST /api/v1/users/{user}/2fa/disable` (`CVE-2026-72822`). The disclosure also included several paths to **remote code execution**. In the API plugin, `CVE-2026-72830` allows attackers with `api.config.write` access to alter scheduler settings and inject commands through `scheduler.custom_jobs`, while `CVE-2026-72824` can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, `CVE-2026-72819` allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and `CVE-2026-72827` enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to **Grav `2.0.13`** and **API plugin `1.0.13`**, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Aug 19, 2026
A high-severity path traversal flaw tracked as **CVE-2026-69089** affects **Grav CMS** before version **2.0.11**, with exploitation confirmed in **2.0.10**. The bug resides in `ImageMedium::watermark()`, where an unsanitized `$image` argument is passed to `RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource()`. Because `file://` path handling only collapses `..` segments lexically and does not enforce a `realpath` or containment check, attackers can traverse outside Grav's intended media sandbox. An editor able to author Markdown image syntax can abuse the watermark feature to reference arbitrary image files on the server, causing those files to be composited into another image. Grav then caches and serves the resulting image from a public unauthenticated URL, enabling anonymous information disclosure. The issue is classified as **CWE-22** with a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`, and **Grav CMS 2.0.11** is reported as unaffected.
Aug 3, 2026
The Apache Software Foundation reported handling **376 new vulnerability reports** across **101** top-level projects in 2020, closing 341 cases and assigning **151 CVEs** while adopting new tooling and the CVE automation API to speed disclosure. The report highlighted several high-profile issues, including the Apache Struts flaw tracked as `CVE-2019-0230`, where forced double OGNL evaluation in tag attributes can lead to **remote code execution** in Struts `2.0.0` through `2.5.20`, alongside other notable Apache security events that drew public exploit or proof-of-concept attention. Additional disclosures tied to that period included two Apache Flink directory traversal bugs, `CVE-2020-17518` and `CVE-2020-17519`, affecting exposed REST APIs and enabling arbitrary file write or read access on vulnerable JobManager hosts; Apache said users should upgrade to **Flink 1.11.3 or 1.12.0**. Apache also published `CVE-2020-13951`, a denial-of-service issue in the public NetTest web service of Apache OpenMeetings `4.0.0` through `5.0.0`, and `CVE-2019-0235`, a **CSRF** flaw in Apache OFBiz `17.12.01`, underscoring the breadth of web, file-system, and application-layer risks disclosed across Apache projects.
Aug 15, 2026