Path Traversal Vulnerability in Grav by GetGrav

CVE-2026-72695

What is CVE-2026-72695?

Grav, prior to version 2.0.16, is susceptible to a path traversal vulnerability within the MediaUploadTrait::deleteFile() function. This flaw allows authenticated users with media management permissions to bypass security measures and delete arbitrary files by manipulating filenames to include directory traversal sequences. The vulnerability arises from the method's inadequate validation, which only assesses the basename of the filename while allowing unvalidated directory paths, including '../' sequences, to be passed to the unlink() function. Consequently, this permits exploitation that can lead to the deletion of files outside the designated media storage directory.

References