{"schema":"threatline.record/2","record":{"id":"GHSA-8pcm-97fc-4xwh","aliases":["GHSA-8pcm-97fc-4xwh"],"summary":"API plugin: anonymous translation requests grow the cache without limit, and translation sync and batch copy skip page rules","details":"## Summary\nThe public `GET /api/v1/translations/{lang}` endpoint of the Grav API plugin cached a full copy of the translation dictionary for seven days for every well-formed language code it was sent, whether or not any language file exists for that code. An unauthenticated visitor could grow the site's cache without limit, filling the disk on hosts that use the file cache or constantly evicting APCu.\n\nSeparately, `POST /api/v1/pages/{route}/sync` checked the page rules of the source translation but wrote the target, and `POST /api/v1/pages/batch` with `copy` did not check the destination's `create` rule. An account with `api.pages.write` could therefore get past page-level permission rules the site had set against it.\n\n## Affected versions\ngrav-plugin-api 1.0.40 and 1.0.41 for the translations cache. 1.0.16 through 1.0.41 for the sync and batch copy checks.\n\n## Details\nLanguage codes that no core, plugin, theme or site file ships now resolve to the site default, and prefixed requests are filtered from the cached full dictionary instead of being stored under their own key. Sync now requires `update` on the target translation, and batch copy applies the destination's `create` rule, as single-page copy, move and reorganize already did.\n\nOn this install each crafted request of under 100 bytes stored a cache entry of about 560 KB.\n\nThe report also noted that `GET /pages/{route}/compare` returns the source of a page whose Twig content the caller may not edit. Reading page source is within `api.pages.read`, so that is not part of this advisory, but compare now applies the same check as opening the page.\n\n## Impact\nAny visitor, with no account, can exhaust disk or cache and take the site down. Accounts with `api.pages.write` can overwrite a translation, or create pages under a section, that page-level rules deny them.\n\n## Patches\nFixed in grav-plugin-api 1.0.42.\n\n## Credits\nReported by @ma4ter.\n","categories":["Unclassified"],"product":"getgrav/grav-plugin-api","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-8pcm-97fc-4xwh","source_modified_at":"2026-10-04T23:59:47Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"composer","name":"getgrav/grav-plugin-api"},"range":">= 1.0.16, < 1.0.42"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/getgrav/grav/security/advisories/GHSA-8pcm-97fc-4xwh","source_modified_at":"2026-10-04T23:59:47Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"ecosystem":"composer","name":"getgrav/grav-plugin-api"},"version":"1.0.42"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-04T23:59:47Z","modified_at":"2026-10-04T23:59:47Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/getgrav/grav/security/advisories/GHSA-8pcm-97fc-4xwh","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-04T23:59:47Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-04T23:59:47Z","content_hash":"fccfdc7ef620f0e567bd15cf957b46f9efaaf2a41f28687c156713a3d61db65f"}}