Executive brief
Grav is a flat-file CMS platform used to build and manage web content. A path traversal vulnerability in its media file deletion feature allows authenticated users with media management permissions to delete arbitrary files from the server, potentially compromising system configuration files and disrupting operations.
Technical details
This is a path traversal vulnerability (CWE-22) in MediaUploadTrait::deleteFile() in system/src/Grav/Common/Media/Traits/MediaUploadTrait.php. The vulnerable code validates only the basename of the filename using Utils::checkFilename(), but fails to validate the directory path component, which may contain directory traversal sequences (../) that bypass the security check. An authenticated user with media management permissions can supply a filename like "../../config/system.yaml" to delete arbitrary files outside the intended media storage directory. The traversal path is reconstructed and passed unvalidated to unlink(), enabling file deletion outside the media folder. Grav versions before 2.0.16 are affected; version 2.0.16 and later include a patch.
Affected products
- Grav Grav < 2.0.16
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Version 2.0.16 includes the patch