Executive brief
The Grav API Plugin, which provides programmatic access to the Grav content management system, contains a security flaw in how it handles page relocation requests. An authorized user with basic content editing permissions can exploit this to move website files and media to restricted locations on the server's hard drive. This could lead to data loss, website corruption, or the unauthorized placement of files in sensitive system directories.
Technical details
A path traversal vulnerability exists in the `PagesController::move()` method of the Grav API Plugin (getgrav/grav-plugin-api) before version 1.0.10. The application attempts to sanitize the `slug` field using `ltrim($body['slug'], '.')`, which only removes leading periods and fails to neutralize directory traversal sequences like `../` or absolute paths. An authenticated attacker with `api.pages.write` permissions can provide a crafted slug (e.g., `01.home/../../../pwned`) to move a page directory, including its content and media, to any writable location on the server. This bypasses the intended confinement within the `user/pages/` directory and can be used to move files outside the Grav installation root. The issue is addressed in version 1.0.10.
Affected products
- getgrav Grav API Plugin < 1.0.10
Timeline
- 2026-07-09: advisory: GitHub Security Advisory GHSA-qjq4-jp55-4mx2 published
- 2026-07-23: disclosed: CVE-2026-65896 published to NVD