Path Traversal Vulnerability in Grav CMS by GetGrav
CVE-2025-66302

6.8MEDIUM

Key Information:

Vendor

Getgrav

Status
Grav
Vendor
CVE Published:
1 December 2025

What is CVE-2025-66302?

Grav, a file-based web platform, has been found vulnerable to a path traversal issue. This vulnerability allows authenticated attackers with administrative privileges to access and read arbitrary files from the server’s filesystem. The flaw originates from inadequate input sanitization in the backup tool, where users are permitted to supply paths that are not sufficiently restricted, resulting in the ability to traverse to directories outside the intended webroot. The potential impact varies based on the privileges of the user account executing the application. Users are strongly advised to update to version 1.8.0-beta.27 or later to mitigate this vulnerability.

Affected Version(s)

grav < 1.8.0-beta.27

References

https://github.com/getgrav/grav/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/getgrav/grav/commit/ed640a13143c4177af...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.