Executive brief
Grav is a flat-file CMS platform used to build and manage websites without a database. The admin plugin's "Save As" feature contains a flaw that allows authenticated administrators with page-creation permissions to write arbitrary Markdown files anywhere on the server by supplying directory traversal sequences in a language parameter. An attacker with these credentials could overwrite critical system files or inject malicious content, potentially compromising the entire website or server.
Technical details
A path traversal vulnerability exists in the Grav admin plugin's taskSaveas() handler, where the lang POST parameter is used directly to construct a filesystem path without validation or sanitization. The determineFilenameIncludingLanguage() function embeds the attacker-controlled lang value into a filename with only an in_array() check to decide suffix-stripping, failing to reject traversal sequences like "../". An authenticated admin user with admin.pages.create permission can supply directory traversal sequences (e.g., "../../../../../../tmp/") in the lang parameter to write arbitrary .md files outside the pages directory. The page content is fully attacker-controlled via the frontmatter and content POST fields, enabling arbitrary file writes. The vulnerability was patched in Grav 1.10.55.
Affected products
- Grav Grav before 1.10.55
Timeline
- 2026-08-20: disclosed: GitHub Security Advisory GHSA-h9g9-73c3-23c9 published
- 2026-09-04: patched: Fixed in Grav 1.10.55