{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/grav-api-plugin-before-1.0.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-65896"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav API Plugin (before 1.0.10)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","web-application","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eCVE-2026-65896 describes a path traversal vulnerability in the Grav API Plugin (Composer package getgrav/grav-plugin-api) versions prior to 1.0.10. This flaw affects the \u003ccode\u003ePOST /pages/{route}/move\u003c/code\u003e endpoint, specifically within the \u003ccode\u003ePagesController::move()\u003c/code\u003e function, where the \u003ccode\u003eslug\u003c/code\u003e field from the request body is not adequately validated. The sanitization process only strips leading periods, failing to neutralize path traversal sequences like '/' or '..'. An authenticated API caller possessing the \u003ccode\u003eapi.pages.write\u003c/code\u003e permission can leverage this vulnerability to move entire page directories, including their content and media files, to arbitrary writable locations outside the intended \u003ccode\u003euser/pages/\u003c/code\u003e directory, and potentially outside the Grav installation entirely. This could lead to unauthorized modification, disruption of services, or data exposure by relocating critical application components.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains valid API credentials for a Grav instance, ensuring they have the \u003ccode\u003eapi.pages.write\u003c/code\u003e permission.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/pages/{route}/move\u003c/code\u003e endpoint of the Grav API.\u003c/li\u003e\n\u003cli\u003eWithin the POST request body, the attacker includes a \u003ccode\u003eslug\u003c/code\u003e parameter containing path traversal sequences, such as \u003ccode\u003e01.home/../../../pwned\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Grav API Plugin, specifically \u003ccode\u003ePagesController::move()\u003c/code\u003e, receives this request.\u003c/li\u003e\n\u003cli\u003eThe vulnerability in the plugin causes inadequate sanitization of the \u003ccode\u003eslug\u003c/code\u003e parameter, allowing the path traversal sequences to be processed.\u003c/li\u003e\n\u003cli\u003eThe Grav application interprets these sequences as legitimate directory navigation instructions.\u003c/li\u003e\n\u003cli\u003eThe application then moves the specified Grav page directory (including its content and media) to the arbitrary, attacker-controlled writable location specified by the traversal sequences.\u003c/li\u003e\n\u003cli\u003eThis results in unauthorized file system modifications, potentially leading to data manipulation, application disruption, or a stepping stone for further compromise of the Grav installation or underlying server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of CVE-2026-65896 can result in significant unauthorized file system manipulation. Attackers can move entire Grav page directories to arbitrary locations, including outside the Grav installation path. This can lead to disruption of the web application, data exposure if sensitive files are moved to publicly accessible locations, or even system compromise if critical configuration or system files are overwritten or moved to facilitate further attacks. The CVSS v3.1 Base Score of 7.1 indicates a high severity risk, emphasizing the potential for major damage to confidentiality, integrity, and availability of the Grav installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Grav API Plugin (Composer package getgrav/grav-plugin-api) to version 1.0.10 or newer immediately to patch CVE-2026-65896.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) or API Gateway capable of inspecting HTTP POST body parameters for path traversal sequences like \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e/./\u003c/code\u003e, and absolute paths in requests to API endpoints, particularly \u003ccode\u003e/pages/*/move\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor API authentication logs for unusual access patterns or the creation/modification of highly privileged API keys that could be used to exploit vulnerabilities requiring authenticated access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T12:23:32Z","date_published":"2026-07-23T12:23:32Z","id":"https://feed.craftedsignal.io/briefs/2026-07-grav-api-path-traversal/","summary":"An authenticated API caller with 'api.pages.write' permission in Grav API Plugin (Composer package getgrav/grav-plugin-api) before version 1.0.10 can exploit a path traversal vulnerability (CVE-2026-65896). The 'POST /pages/{route}/move' endpoint's 'slug' field is not properly sanitized, allowing attackers to use path traversal sequences (e.g., '01.home/../../../pwned'). This enables them to move an entire page directory, including content and media, to an arbitrary writable location outside the intended 'user/pages/' directory, potentially leading to unauthorized file manipulation or system compromise.","title":"Grav API Plugin Path Traversal Vulnerability (CVE-2026-65896)","url":"https://feed.craftedsignal.io/briefs/2026-07-grav-api-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav API Plugin (Before 1.0.10)","version":"https://jsonfeed.org/version/1.1"}