DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72695: CVE-2026-72695: Authenticated Path Traversal and Arbitrary File Deletion in Grav CMS MediaUploadTrait

#security #cve #cybersecurity

CVE-2026-72695: Authenticated Path Traversal and Arbitrary File Deletion in Grav CMS MediaUploadTrait

Vulnerability ID: CVE-2026-72695
CVSS Score: 8.1
Published: 2026-09-17

A path traversal vulnerability exists in Grav CMS versions prior to 2.0.16. The flaw occurs within the file validation mechanisms of the MediaUploadTrait, enabling authenticated users with media management privileges to bypass sandbox limitations. This allows the deletion of arbitrary files on the filesystem, which can result in denial of service or remote code execution.

TL;DR

An authenticated path traversal vulnerability in Grav CMS before 2.0.16 allows media administrators to delete arbitrary files on the system by bypassing incomplete directory validation checks in the MediaUploadTrait.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22: Improper Limitation of a Pathname to a Restricted Directory
  • Attack Vector: Network (Unauthenticated: No, Requires authenticated media management privileges)
  • CVSS v3.1 Score: 8.1 (High)
  • EPSS Score: 0.00567 (Percentile: 45.53%)
  • Impact: Arbitrary File Deletion / Denial of Service / Remote Code Execution
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed in CISA KEV Catalog

Affected Systems

  • Grav CMS installations prior to version 2.0.16
  • Plugins incorporating system/src/Grav/Common/Media/Traits/MediaUploadTrait.php
  • Grav CMS: < 2.0.16 (Fixed in: 2.0.16)

Code Analysis

Commit: f6883ed

Fix file validation in MediaUploadTrait to prevent path traversal during file deletion and upload processes

Exploit Details

Mitigation Strategies

  • Upgrade Grav CMS to version 2.0.16 or newer.
  • Enforce strict filesystem permissions restricting write access to configuration folders.
  • Implement WAF rules targeting directory traversal sequences in media endpoints.
  • Restrict administrative media management permissions using role-based access control.

Remediation Steps:

  1. Identify vulnerable Grav installations running versions prior to 2.0.16.
  2. Download the updated Grav CMS core package or execute the command-line update tool 'bin/gpm self-upgrade'.
  3. Verify the integration of commit f6883ed50764cb7dea41f9260e096374b4e17aeb in the codebase.
  4. Check third-party plugins utilizing MediaUploadInterface to ensure they inherit the updated traits.

References

Read the full report for CVE-2026-72695 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)