Path Traversal Vulnerability in Grav CMS by GetGrav

CVE-2025-66302

What is CVE-2025-66302?

Grav, a file-based web platform, has been found vulnerable to a path traversal issue. This vulnerability allows authenticated attackers with administrative privileges to access and read arbitrary files from the server’s filesystem. The flaw originates from inadequate input sanitization in the backup tool, where users are permitted to supply paths that are not sufficiently restricted, resulting in the ability to traverse to directories outside the intended webroot. The potential impact varies based on the privileges of the user account executing the application. Users are strongly advised to update to version 1.8.0-beta.27 or later to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References