CVE-2026-69089 in Grav
Summary
by MITRE • 08/03/2026
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within Grav CMS version 2.0.10 where the ImageMedium::watermark() method fails to properly sanitize user input before processing image operations. The flaw occurs when an editor creates Markdown content containing image syntax with traversal sequences that exploit the underlying resource locator mechanism. The RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource() function processes these unsanitized paths without implementing proper containment checks, specifically failing to validate that the requested resources remain within Grav's designated media sandbox boundaries.
The technical implementation of this vulnerability stems from the file:// scheme handler within the resource locator which performs only lexical collapse of '..' segments rather than comprehensive path validation. This allows attackers to craft malicious image references that traverse outside the intended media directory structure. When the watermarking process executes, it processes these malicious paths and incorporates external image files into the final composited output, creating a cached version that becomes publicly accessible through unauthenticated URLs.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to access arbitrary image files from the server filesystem that should normally remain protected within Grav's media sandbox. Anonymous visitors can discover and retrieve these cached composite images containing sensitive content from outside directories, effectively bypassing authentication mechanisms and access controls. The cached nature of these images means that once exploited, the disclosed content remains accessible until the cache is cleared or the affected files are removed.
This vulnerability directly maps to CWE-22 - Improper Limitation of a Pathname to a Restricted Directory and aligns with ATT&CK technique T1083 - File and Directory Discovery. The attack chain follows the pattern of initial access through content creation, followed by path traversal exploitation, and concludes with unauthorized data exposure. Organizations using Grav CMS should implement immediate mitigations including input validation for image paths, implementation of proper containment checks before resource resolution, and regular cache clearing procedures to prevent long-term exposure.
The root cause lies in insufficient input sanitization and lack of proper containment verification within the file system access layer. Security measures should include validating all user-supplied paths against a whitelist of allowed directories, implementing realpath() checks to ensure paths remain within expected boundaries, and applying proper access controls to prevent traversal attacks. Organizations should also consider updating to patched versions of Grav CMS where this vulnerability has been addressed through proper path validation mechanisms and containment checks that prevent external file inclusion during image processing operations.