Executive brief
Grav, a popular file-based content management system, contains a security flaw in how it handles temporary form data. An unauthenticated attacker can exploit this to create unauthorized folders and files on the web server. This could allow an attacker to disrupt website operations, corrupt site data, or potentially change the website's configuration.
Technical details
A path traversal vulnerability exists in the FormFlash core component of Grav CMS due to insufficient sanitization of the session_id parameter. The FormFlash::__construct() and getTmpDir() methods use the raw session identifier (passed via the __form-flash-id POST parameter) to construct filesystem paths for temporary form storage. An unauthenticated remote attacker can use '../' sequences to escape the intended temporary directory and create arbitrary subdirectories and 'index.yaml' files in any location writable by the web server process, such as configuration or cache folders. This can lead to configuration injection or denial of service. The issue is resolved in version 2.0.0-beta.2 by implementing a strict alphanumeric allowlist for session identifiers.
Affected products
- getgrav Grav < 2.0.0-beta.2
Timeline
- 2026-04-24: patched: Fix applied to the 2.0 branch
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD