CVE-2026-85603: Grav admin plugin path traversal in Save As language parameter

CVE-2026-85603 · Severity: medium · CVSS 6.5 · Published 2026-09-04

Grav is a flat-file CMS platform used to build and manage websites without a database. The admin plugin's "Save As" feature contains a flaw that allows authenticated administrators with page-creation permissions to write arbitrary Markdown files anywhere on the server by supplying directory traversal sequences in a language parameter. An attacker with these credentials could overwrite critical system files or inject malicious content, potentially compromising the entire website or server.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-85603 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-85603 being exploited in the wild.
How severe is CVE-2026-85603?
Medium severity, with a CVSS score of 6.5, published 4 September 2026.
Which products and versions are affected?
Grav before 1.10.55.
Is there a fix for CVE-2026-85603?
A patch was published on 2026-09-04: Fixed in Grav 1.10.55 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85603 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-85603?
Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Grav admin plugin's taskSaveas() handler, where the lang POST parameter is used directly to construct a filesystem path without validation or sanitization. The determineFilenameIncludingLanguage() function embeds the attacker-controlled lang value into a filename with only an in_array() check to decide suffix-stripping, failing to reject traversal sequences like "../". An authenticated admin user with admin.pages.create permission can supply directory traversal sequences (e.g., "../../../../../../tmp/") in the lang parameter to write arbitrary .md files outside the pages directory. The page content is fully attacker-controlled via the frontmatter and content POST fields, enabling arbitrary file writes. The vulnerability was patched in Grav 1.10.55.

Affected products

  • Grav Grav before 1.10.55

Timeline

  • 2026-08-20: disclosed: GitHub Security Advisory GHSA-h9g9-73c3-23c9 published
  • 2026-09-04: patched: Fixed in Grav 1.10.55

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.