Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of directory paths in MediaUploadTrait::deleteFile, which allows an authenticated attacker with media management permissions to use ../ sequences to delete arbitrary files outside the intended media storage...

Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...

GHSA-896W-CW95-XQ7W Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...

CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...