CVE-2026-75830 in Plugin Api
Summary
by MITRE • 08/18/2026
grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The grav-plugin-api component, specifically versions ranging from 1.0.0-beta.10 through 1.0.14, contains a critical path traversal vulnerability within the PagesController::batchCopy() method. This flaw stems from an incomplete remediation of a previously identified security issue referenced as GHSA-qjq4-jp55-4mx2. The core technical deficiency lies in the failure to properly validate or sanitize user-supplied input for the suffix parameter when processing POST requests directed at the /api/v1/pages/batch endpoint. While previous fixes may have addressed other vectors, this specific parameter remained exposed to manipulation by authenticated users who possess api.pages.write permissions, a privilege level typically assigned to editors rather than super-administrators.
From an operational perspective, this vulnerability allows for significant unauthorized file system access and modification. By injecting path traversal sequences such as /../../../ into the suffix parameter, an attacker can manipulate the destination directory structure used by the batch copy operation. This enables the attacker to escape the intended user/pages/ directory boundary and write content to arbitrary locations on the server's filesystem that are writable by the web server process. The impact extends beyond simple data leakage; it allows for the placement of malicious page content or media files in sensitive areas, potentially leading to remote code execution if those locations are interpreted as executable scripts or configuration files by the underlying application logic.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The attack vector is classified under ATT&CK technique T1083: File and Directory Discovery when used for reconnaissance, but more critically falls under T1564: Host File System Modification or T1105: Ingress Tool Transfer depending on the specific payload delivered via the written files. The existence of this flaw in a plugin that is widely deployed within Grav CMS installations poses a substantial risk to environments where editor-level accounts are provisioned, as it bypasses the principle of least privilege by allowing lower-tier users to affect system-wide file structures.
Mitigation strategies must prioritize immediate upgrading to version 1.0.15 or later, which contains the complete fix for this path traversal issue. In scenarios where an upgrade is not immediately feasible, administrators should implement strict input validation on the suffix parameter at a WAF level if possible, ensuring that any sequence resembling directory traversal patterns such as dot-dot-slash combinations are blocked before reaching the application logic. Additionally, reviewing and restricting api.pages.write permissions to only those users who absolutely require them can reduce the attack surface. Regular auditing of file system permissions for directories writable by the web server process is also recommended to limit the potential impact should similar vulnerabilities be discovered in other components.