CVE-2026-65896 in grav
Summary
by MITRE • 07/23/2026
Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability exists within the Grav API Plugin version prior to 1.0.10 where the PagesController::move() method fails to adequately validate user-supplied slug values during page movement operations. This flaw specifically affects the POST /pages/{route}/move endpoint and represents a critical path traversal vulnerability that can be exploited by authenticated attackers with api.pages.write permissions. The sanitization process employs only ltrim($body['slug'], '.') which removes leading periods from the slug but leaves other potentially dangerous sequences intact, including forward slashes and dot-dot sequences that enable directory traversal attacks.
This security weakness allows malicious actors to manipulate page movement operations by crafting specially formatted slugs containing path traversal sequences such as 01.home/../../../pwned. The incomplete sanitization process fails to neutralize forward slash characters and double-dot segments that would normally be rejected by proper path validation mechanisms. When an authenticated user with appropriate permissions submits a malicious slug, the system processes this input without sufficient validation, enabling the movement of entire page directories complete with their associated content and media files to arbitrary locations outside the intended user/pages/ directory structure.
The operational impact of this vulnerability extends beyond simple unauthorized file access, as it enables attackers to potentially move critical application components or sensitive data to locations outside the Grav installation boundaries. This could result in complete compromise of the application's integrity and availability, as attackers can relocate entire page structures including configuration files, media assets, and content directories to locations where they may be accessible or executable by unauthorized parties. The vulnerability essentially provides an attacker with a mechanism to bypass normal file system access controls and potentially gain persistent access to the application's data repository.
The technical nature of this flaw aligns with CWE-23 Path Traversal and CWE-77 Path Traversal Vulnerability, where insufficient input validation allows attackers to manipulate file paths through maliciously crafted input parameters. From an attack perspective, this vulnerability maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing commands through the API interface and potentially T1566 Credential Access through privilege escalation via API permissions. The vulnerability demonstrates a classic case of inadequate input sanitization where the system fails to validate that user-supplied data conforms to expected path formats, allowing for arbitrary directory traversal operations. Proper mitigation requires implementing comprehensive path validation that rejects all non-alphanumeric characters except those explicitly permitted in URL-safe slugs while ensuring that any potentially dangerous sequences are neutralized through proper input filtering and validation routines.
The fix for this vulnerability requires implementing robust input validation that thoroughly sanitizes all user-supplied slug values before processing them in the move operation. This includes rejecting any slug containing forward slashes, dot-dot sequences, or other path traversal patterns that could enable directory traversal attacks. The solution should also validate that the target path remains within the designated application boundaries and that all movement operations occur within properly constrained directories. Additionally, proper logging of all page movement operations should be implemented to detect and alert on suspicious activities that may indicate exploitation attempts.