Executive brief
Grav CMS, a popular open-source flat-file content management system, contains a vulnerability in its media_directory() Twig template function that allows authenticated page editors to read arbitrary files from the server filesystem. An attacker with page authoring privileges can exploit this to enumerate directories and disclose file contents of configuration files, source code, and other sensitive data that the web server process can access.
Technical details
The vulnerability is a path traversal flaw in the media_directory() Twig function (GravExtension::mediaDirFunc()) that fails to validate or restrict filesystem paths. The function checks only if the input looks like a Grav stream (user://, theme://, etc.); if it is a plain filesystem path (absolute or relative), the check is bypassed and the path is passed directly to the Media class constructor. The sandbox's allow-list for the Medium class incorrectly includes the filepath accessor, contradicting a code comment stating it should remain blocked. An authenticated user with page authoring privileges—including those with process.twig enabled in frontmatter or any modular page—can supply arbitrary filesystem paths to media_directory() and read the contents of any file matching configured media extensions (txt, json, xml, pdf, doc, docx, etc.) that the web server process can read. The vulnerability affects Grav CMS versions prior to 2.0.16 and is patched in version 2.0.16.
Affected products
- Grav CMS < 2.0.16
Timeline
- 2026-08-10: disclosed
- 2026: patched: Version 2.0.16 released
- 2026-08-25: advisory