# CVE-2026-85603: Grav admin plugin path traversal in Save As language parameter

Source: https://junglewise.ai/threats/cve-2026-85603-grav-admin-plugin-path-traversal-in-save-as-language-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85603 · Severity: medium · CVSS 6.5 · Published 2026-09-04

Grav is a flat-file CMS platform used to build and manage websites without a database. The admin plugin's "Save As" feature contains a flaw that allows authenticated administrators with page-creation permissions to write arbitrary Markdown files anywhere on the server by supplying directory traversal sequences in a language parameter. An attacker with these credentials could overwrite critical system files or inject malicious content, potentially compromising the entire website or server.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav).

## Quick answers

**Is CVE-2026-85603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85603 being exploited in the wild.

**How severe is CVE-2026-85603?** Medium severity, with a CVSS score of 6.5, published 4 September 2026.

**Which products and versions are affected?** Grav before 1.10.55.

**Is there a fix for CVE-2026-85603?** A patch was published on 2026-09-04: Fixed in Grav 1.10.55 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85603 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85603?** Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the Grav admin plugin's taskSaveas() handler, where the lang POST parameter is used directly to construct a filesystem path without validation or sanitization. The determineFilenameIncludingLanguage() function embeds the attacker-controlled lang value into a filename with only an in_array() check to decide suffix-stripping, failing to reject traversal sequences like "../". An authenticated admin user with admin.pages.create permission can supply directory traversal sequences (e.g., "../../../../../../tmp/") in the lang parameter to write arbitrary .md files outside the pages directory. The page content is fully attacker-controlled via the frontmatter and content POST fields, enabling arbitrary file writes. The vulnerability was patched in Grav 1.10.55.

## Affected products

- Grav Grav before 1.10.55

## Timeline

- 2026-08-20: disclosed: GitHub Security Advisory GHSA-h9g9-73c3-23c9 published
- 2026-09-04: patched: Fixed in Grav 1.10.55

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-h9g9-73c3-23c9](https://github.com/getgrav/grav/security/advisories/GHSA-h9g9-73c3-23c9)
- [https://www.vulncheck.com/advisories/grav-admin-plugin-path-traversal-via-save-as-language-code](https://www.vulncheck.com/advisories/grav-admin-plugin-path-traversal-via-save-as-language-code)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)