Path Traversal Vulnerability in Grav CMS Prior to Version 2.0.16

CVE-2026-72697

What is CVE-2026-72697?

Grav CMS versions prior to 2.0.16 are susceptible to a path traversal vulnerability found in the media_directory() Twig function. This vulnerability arises from inadequate validation of filesystem paths, which allows authenticated users to exploit the flaw. Attackers with page authoring privileges can manipulate the filesystem paths supplied to media_directory(), enabling them to access and enumerate files beyond their intended scope. By exploiting this vulnerability, malicious users can read the contents of unprotected files that match the configured media extensions, significantly compromising the security of the application.

References