Path Traversal Vulnerability in Grav Admin Plugin

CVE-2026-85603

What is CVE-2026-85603?

The Grav admin plugin prior to version 1.10.55 is susceptible to a path traversal vulnerability through its 'Save As' functionality. This flaw occurs due to inadequate validation of the language code parameter, allowing an authenticated admin user with the 'admin.pages.create' permission to inject directory traversal sequences. By exploiting this vulnerability, an attacker could write arbitrary .md files with malicious content outside of the designated pages directory, posing significant security risks for Grav sites.

References