GHSA-W3F4-8PJ2-599W Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...

Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...

Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3f4-8pj2-599w. This link is maintained to preserve external references. Original Description Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $imag...

CVE-2026-69089 Grav CMS before 2.0.11 Path Traversal via watermark

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-69089: Improper Limitation of a Pathname to a Restricted Directory

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

PT-2026-57217

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.53 Grav versions prior to 2.0.0-rc.8 Description An unauthenticated visitor can cause server memory and CPU exhaustion by requesting image derivatives with oversized dimensions. This occurs through URL query image...

CVE-2026-53653: Allocation of Resources Without Limits or Throttling

Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthenticated visitor to exhaust server memory and CPU by requesting image derivatives with oversized dimensions through URL query image actions such as forceResize in Grav::fallbackUrl, which passes request...