# CVE-2026-65896: getgrav Grav API Plugin path traversal in PagesController move endpoint

Source: https://junglewise.ai/threats/cve-2026-65896-getgrav-grav-api-plugin-path-traversal-in-pagescontroller-move  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65896 · Severity: high · CVSS 7.1 · Published 2026-07-23

The Grav API Plugin, which provides programmatic access to the Grav content management system, contains a security flaw in how it handles page relocation requests. An authorized user with basic content editing permissions can exploit this to move website files and media to restricted locations on the server's hard drive. This could lead to data loss, website corruption, or the unauthorized placement of files in sensitive system directories.

Technologies: [Grav API Plugin](https://junglewise.ai/threats/technologies/api-plugin). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-65896 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65896 being exploited in the wild.

**How severe is CVE-2026-65896?** High severity, with a CVSS score of 7.1, published 23 July 2026.

**Which products and versions are affected?** Grav API Plugin < 1.0.10.

**Is there a fix for CVE-2026-65896?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65896 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65896?** Check whether you run Grav API Plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the `PagesController::move()` method of the Grav API Plugin (getgrav/grav-plugin-api) before version 1.0.10. The application attempts to sanitize the `slug` field using `ltrim($body['slug'], '.')`, which only removes leading periods and fails to neutralize directory traversal sequences like `../` or absolute paths. An authenticated attacker with `api.pages.write` permissions can provide a crafted slug (e.g., `01.home/../../../pwned`) to move a page directory, including its content and media, to any writable location on the server. This bypasses the intended confinement within the `user/pages/` directory and can be used to move files outside the Grav installation root. The issue is addressed in version 1.0.10.

## Affected products

- getgrav Grav API Plugin < 1.0.10

## Timeline

- 2026-07-09: advisory: GitHub Security Advisory GHSA-qjq4-jp55-4mx2 published
- 2026-07-23: disclosed: CVE-2026-65896 published to NVD

## References

- [https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd](https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd)
- [https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2](https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2)
- [https://www.vulncheck.com/advisories/grav-api-plugin-before-path-traversal-via-move](https://www.vulncheck.com/advisories/grav-api-plugin-before-path-traversal-via-move)

## Related threats

- [Grav API plugin session validation bypass in disabled accounts](https://junglewise.ai/threats/cve-2026-109320-the-grav-api-plugin-grav-plugin-api-before-1-0-36-contains-an)
- [Grav API Plugin password reset link spoofing via Host header](https://junglewise.ai/threats/cve-2026-86196-grav-api-plugin-password-reset-link-spoofing-via-host-header)
- [Grav API Plugin scope cap bypass in page permissions](https://junglewise.ai/threats/cve-2026-80204-grav-api-plugin-scope-cap-bypass-in-page-permissions)
- [Grav API plugin server-side request forgery in webhook delivery](https://junglewise.ai/threats/cve-2026-56708-grav-api-plugin-server-side-request-forgery-in-webhook-delivery)
- [Grav API Plugin privilege escalation in API key management](https://junglewise.ai/threats/cve-2026-64852-grav-api-plugin-privilege-escalation-in-api-key-management)