CVE-2026-72697 in Grav
Summary
by MITRE • 08/25/2026
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Grav CMS prior to version 2.0.16 represents a critical path traversal flaw located within the media_directory Twig function, which is responsible for managing and serving media assets within the content management system's architecture. This specific component fails to perform adequate validation or sanitization of filesystem paths provided by user input, creating an opportunity for unauthorized file access. The core technical deficiency lies in the lack of strict boundary checks when processing directory arguments, allowing attackers to manipulate path strings using standard traversal sequences such as dot-dot-slash patterns to escape the intended media root directory and navigate into arbitrary locations on the underlying server filesystem.
This flaw is particularly severe because it requires only authenticated access with page authoring privileges rather than full administrative rights, significantly lowering the barrier for exploitation within a multi-user environment. An attacker possessing these moderate-level credentials can inject malicious path parameters into requests targeting the media_directory function. By leveraging this input vector, the system processes the supplied paths without verifying that they remain confined to the designated media storage area. Consequently, the application inadvertently exposes internal file structures and sensitive data residing outside the public-facing web root or protected directories, effectively bypassing standard access controls designed to isolate user-generated content from system files.
The operational impact of this vulnerability extends beyond simple directory enumeration to include the potential disclosure of confidential information stored on the server. Since Grav CMS allows for an allow-listed filepath accessor on Medium objects, attackers can exploit this feature to read the contents of any file that matches the configured media extensions and is accessible by the web server process identity. This capability enables the extraction of sensitive configuration files, database credentials, source code from other applications hosted on the same machine, or private user data stored within the CMS structure. The ability to enumerate files also aids in further reconnaissance, allowing attackers to map out the system architecture and identify additional targets for exploitation.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves failing to restrict access to resources outside of an intended directory hierarchy. Additionally, the technique used by attackers to navigate through the filesystem corresponds to ATT&CK T1083 File and Directory Discovery, which describes methods for identifying files and directories on local or remote systems. The exploitation chain also touches upon CWE-200 Exposure of Sensitive Information to an Unauthorized Actor due to the resulting leakage of file contents that were not intended for public consumption.
To mitigate this risk, organizations running Grav CMS must immediately upgrade to version 2.0.16 or later, where these path validation mechanisms have been corrected. In addition to applying the software patch, administrators should enforce strict principle of least privilege by ensuring that web server processes operate with minimal necessary permissions and do not run under high-privilege accounts capable of accessing sensitive system files. Implementing robust input validation at the application layer is also recommended as a defense-in-depth measure, although relying solely on this without upgrading remains insufficient given the depth of the flaw in older versions. Regular security audits and monitoring for unusual file access patterns can further help detect potential exploitation attempts before significant data loss occurs.