{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/grav-cms--2.0.15/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-72695"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav CMS (\u003c= 2.0.15)","Grav CMS (2.0.15)"],"_cs_severities":["high"],"_cs_tags":["grav","cms","path-traversal","cve-2026-72695","file-disclosure","web-application"],"_cs_type":"advisory","_cs_vendors":["GetGrav"],"content_html":"\u003cp\u003eGrav CMS versions 2.0.15 and earlier are vulnerable to a path traversal vulnerability in the \u003ccode\u003eMediaUploadTrait::deleteFile()\u003c/code\u003e method within \u003ccode\u003esystem/src/Grav/Common/Media/Traits/MediaUploadTrait.php\u003c/code\u003e. The vulnerability arises because the application only performs filename validation on the basename using \u003ccode\u003eUtils::checkFilename()\u003c/code\u003e while failing to sanitize the directory path component. An authenticated user with media management permissions can exploit this by submitting specially crafted filenames containing directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e). When passed to the \u003ccode\u003edoRemove()\u003c/code\u003e method, these sequences allow the application to bypass directory restrictions and invoke \u003ccode\u003eunlink()\u003c/code\u003e on files located outside the intended media storage path. This vulnerability can be used to cause a denial of service by deleting critical system configurations, application logic, or authentication-related files, potentially resulting in privilege escalation or complete system disruption.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker with page or media editing permissions initiates a request to the Grav CMS admin interface.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers a Flex media handling operation, such as editing a page, that allows media deletion.\u003c/li\u003e\n\u003cli\u003eThe attacker intercepts or crafts a POST request to the \u003ccode\u003e/admin/pages/[page]/task:save\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request payload is modified to include a media deletion marker with a key containing path traversal sequences (e.g., \u003ccode\u003e../../data/target.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application’s \u003ccode\u003eFlexMediaTrait::saveUpdatedMedia()\u003c/code\u003e method processes the deletion queue, passing the unsanitized traversal string to \u003ccode\u003edeleteFile()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edeleteFile()\u003c/code\u003e method validates only the basename (e.g., \u003ccode\u003etarget.txt\u003c/code\u003e), which passes the \u003ccode\u003eUtils::checkFilename()\u003c/code\u003e filter despite the malicious directory prefix.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edoRemove()\u003c/code\u003e method concatenates the path and invokes the PHP \u003ccode\u003eunlink()\u003c/code\u003e function on the resolved path.\u003c/li\u003e\n\u003cli\u003eThe underlying filesystem executes the deletion of the target file, outside the authorized media directory.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to delete critical application files, including configuration files such as \u003ccode\u003euser/config/system.yaml\u003c/code\u003e or \u003ccode\u003euser/config/security.yaml\u003c/code\u003e, and user account files. This leads to immediate denial of service or potential privilege escalation by removing security restrictions. The impact is significant for environments where untrusted users are granted administrative-level media management access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate Grav CMS to the version containing the patch for CVE-2026-72695 immediately.\u003c/li\u003e\n\u003cli\u003eImplement a custom validation logic for the \u003ccode\u003eMediaUploadTrait\u003c/code\u003e that applies \u003ccode\u003eUtils::checkFilename()\u003c/code\u003e to the entire file path, as documented in the provided fix.\u003c/li\u003e\n\u003cli\u003eAudit administrative permissions and restrict media management access to strictly vetted users.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests to \u003ccode\u003e/admin/pages/\u003c/code\u003e containing path traversal characters like \u003ccode\u003e../\u003c/code\u003e or \u003ccode\u003e..%2f\u003c/code\u003e within the payload.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T01:12:23Z","date_published":"2026-09-18T01:11:09Z","id":"https://feed.craftedsignal.io/briefs/2026-09-grav-path-traversal/","summary":"An authenticated path traversal vulnerability in Grav CMS's MediaUploadTrait allows users with media management permissions to delete arbitrary files on the server by providing crafted file paths.","title":"Grav CMS Path Traversal in MediaUploadTrait Leading to Arbitrary File Deletion","url":"https://feed.craftedsignal.io/briefs/2026-09-grav-path-traversal/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:grav_cms:grav_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-69089"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav CMS (2.0.10)","Grav CMS (\u003c= 2.0.15)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","twig","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["Grav CMS","Grav"],"content_html":"\u003cp\u003eGrav CMS version 2.0.10 contains a path traversal vulnerability in the ImageMedium::watermark() method. The vulnerability arises because the application passes an unsanitized image argument to the RocketTheme\\Toolbox\\ResourceLocator\\UniformResourceLocator::findResource() method. The implementation of the file:// scheme branch fails to perform a proper realpath or containment check, relying only on lexical collapse of '..' path segments.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by crafting malicious Markdown image syntax that includes path traversal sequences. This allows the application to resolve and process files located outside of the designated media directory. The system subsequently composites the unauthorized file into a carrier image, caches the resulting file, and serves it through a public-facing, unauthenticated URL. This leads to the unauthorized disclosure of sensitive image data residing on the web server to remote anonymous visitors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Grav CMS instance running version 2.0.10.\u003c/li\u003e\n\u003cli\u003eAttacker authors a malicious Markdown document containing a crafted image tag.\u003c/li\u003e\n\u003cli\u003eThe image tag includes directory traversal sequences (e.g., ../../) in the watermark parameter.\u003c/li\u003e\n\u003cli\u003eThe ImageMedium::watermark() method receives the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe input is passed to UniformResourceLocator::findResource(), which fails to validate the traversal path.\u003c/li\u003e\n\u003cli\u003eThe application resolves the path to an image file outside the intended web root or media sandbox.\u003c/li\u003e\n\u003cli\u003eThe server processes and composites the unauthorized image into a new file.\u003c/li\u003e\n\u003cli\u003eThe final file is cached and exposed via a public URL, allowing the attacker to download the sensitive content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthenticated disclosure of any image file accessible to the web server process. This could result in the exposure of private administrative images, sensitive site metadata, or other assets not intended for public consumption. Given the CVSS score of 7.5, this poses a high risk to data confidentiality for affected web platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification of all internet-facing instances of Grav CMS version 2.0.10 and upgrade to the latest patched version immediately. Monitor web server access logs for anomalous requests containing path traversal sequences (e.g., ../) targeting image processing parameters or Markdown-related endpoints. Ensure that web server file system permissions follow the principle of least privilege to restrict the web user's access to files outside of the defined document root.\u003c/p\u003e\n","date_modified":"2026-09-18T01:12:47Z","date_published":"2026-08-03T16:06:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-grav-cms-traversal/","summary":"Grav CMS 2.0.10 is vulnerable to path traversal in the ImageMedium::watermark() method, allowing unauthenticated attackers to disclose arbitrary image files by traversing outside the media sandbox.","title":"Path Traversal Vulnerability in Grav CMS ImageMedium Class","url":"https://feed.craftedsignal.io/briefs/2026-08-grav-cms-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Grav CMS (\u003c= 2.0.15)","version":"https://jsonfeed.org/version/1.1"}