CVE-2026-72695

Grav (flat-file CMS) before 2.0.16 is affected by a path traversal vulnerability in MediaUploadTrait::deleteFile(). The method validates only the basename portion of a supplied filename while leaving unvalidated directory paths containing ../ sequences intact, passing the full path to unlink(). T...

EUVD-2026-65209

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...