Path traversal in Grav API Plugin POST /pages/{route}/move endpoint (CVE-2026-65896)

The Grav API Plugin fails to properly sanitize the `slug` field in the `PagesController::move()` method, stripping only leading period characters via `ltrim()` while leaving `/` and `..` path segments unfiltered. An authenticated API caller holding the `api.pages.write` permission can supply path traversal sequences to relocate an entire page directory, including its content and media files, to an arbitrary writable location outside the `user/pages/` tree and potentially outside the entire Grav installation. Affected versions: - <=1.0.9 We recommend updating to: 1.0.10. CVSS 7.1 · our assessment: this_week Reference: https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2 Details: https://vuln.today/cve/CVE-2026-65896