Executive brief
Grav is a file-based content management system (CMS) used to build and manage websites. A security flaw in its API allows a user with limited permissions to upload a specially crafted file that creates a new administrative account. An attacker can use this new account to take full control of the website, including modifying content, changing configurations, and managing other users.
Technical details
An authenticated vertical privilege escalation vulnerability exists in Grav 2.0.0-beta.2 due to improper path validation in the '/api/v1/blueprint-upload' endpoint. By manipulating the 'destination' and 'scope' parameters, an attacker with 'api.media.write' permissions can bypass intended directory restrictions to write arbitrary YAML files into the 'user/accounts/' directory. Since Grav uses these YAML files for user authentication and supports plaintext passwords for initial logins, an attacker can plant a new user file with 'api.super' privileges. This allows the attacker to log in as a super-administrator, resulting in full compromise of the Grav API and the underlying CMS. The issue is fixed in API version 1.0.0-beta.17.
Affected products
- getgrav Grav 2.0.0-beta.2
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by vendor
- 2026-05-12: disclosed: CVE published to NVD