getgrav Grav up to 2.0.10 ImageMedium ImageMedium::watermark image path traversal

Summaryinfo

A vulnerability classified as problematic was found in getgrav Grav up to 2.0.10. Impacted is the function ImageMedium::watermark of the component ImageMedium. Executing a manipulation of the argument image can lead to path traversal. This vulnerability appears as CVE-2026-69089. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in getgrav Grav up to 2.0.10. This vulnerability affects the function ImageMedium::watermark of the component ImageMedium. The manipulation of the argument image with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-69089 since 08/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.0.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-52282). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• getgrav

Name

• Grav

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion