Executive brief
Grav CMS, a popular flat-file content management system, allows page editors to use the `media_directory()` function in template code to reference directories containing media files. A vulnerability in this function fails to validate that the directory paths are restricted to intended site folders, instead accepting any filesystem path the web server process can read. Combined with insufficient sandbox restrictions on file metadata, attackers can read the content of sensitive files system-wide—including configuration, credentials, and other tenants' data on shared hosting—bypassing intended security boundaries.
Technical details
The vulnerability is a path traversal flaw in `GravExtension::mediaDirFunc()` combined with overpermissive sandbox allow-listing. The function checks whether its input is a Grav stream (e.g., `user://`, `theme://`) and resolves it if so, but if the input is a plain filesystem path—the normal documented shape—the check is skipped and the raw path is passed directly to the `Media` class constructor without validation. The `Media` class then enumerates and indexes all files in that directory matching configured media extensions (by default: `txt`, `json`, `xml`, `pdf`, `doc`, `docx`, image formats, and others). A second gap: the `Medium` class's `filepath` accessor—which returns the absolute filesystem path to a file—is included in the Twig sandbox's allow-list despite a code comment explicitly stating it should remain blocked. An attacker with page-authoring privileges can invoke `media_directory('/etc')` or any other path, enumerate files matching media extensions, and read their contents via the `filepath` property. Affected versions include at least 2.0.15; the advisory recommends validating paths with `realpath()` and enforcing containment within an allowed root, or removing `filepath` from the sandbox allow-list.
Affected products
- Getgrav Grav 2.0.15 and likely earlier versions
Timeline
- 2026-09-17: disclosed: Advisory GHSA-47ch-6w46-6xm7 published
- 2026-09-17: kev added: CVE-2026-72697 assigned