Executive brief
Grav CMS's media management system contains a flaw that allows authenticated users with media editing permissions to delete files anywhere on the server, not just intended media uploads. By crafting requests with directory-escape sequences in filenames, an attacker could delete critical configuration files, user accounts, or other pages' content, causing data loss and potentially disabling the application.
Technical details
The vulnerability is a path traversal (CWE-22) in the `deleteFile()` method of MediaUploadTrait. The method validates only the filename basename using `Utils::checkFilename()`, allowing directory path components containing `../` sequences to bypass validation and be passed unescaped to `unlink()`. An authenticated user with page/media editing permissions can exploit this through the Flex media handling pipeline by submitting form data with traversal sequences in the media deletion keys. The attacker can escape the intended `user/pages/` media directory to delete arbitrary files. Fix: apply `checkFilename()` validation to the full filename parameter before path decomposition.
Affected products
- Grav Grav CMS 2.0.16 and earlier
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory: GHSA-jq29-c7v8-rg55