EUVD-2026-65209
GHSA-896w-cw95-xq7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain credentials for media-manager account
-
DeliveryAuthenticate to Grav admin panel
-
ExploitCraft filename with ../ traversal sequences
-
ExecutionSubmit deletion request via media management API
-
PersistPHP unlink() deletes arbitrary server file
-
ImpactDisrupt CMS operation or destroy configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Grav CMS session for a user account that holds media management permissions (the ability to upload or delete media files). This is typically assigned to content editor or author roles, not just administrators. The vulnerability is triggered through the media file deletion functionality exposed in the Grav admin panel or API. Limiting factors: unauthenticated users cannot exploit this; the attacker must obtain valid credentials and specifically hold media delete rights. The affected code path requires the targeted Grav instance to be running a version prior to 2.0.16. There are no additional configuration prerequisites - any default Grav installation with a non-admin user holding media permissions is vulnerable. |
| Impact | The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) contains a significant inconsistency: it records high Confidentiality impact but zero Integrity or Availability impact, which directly contradicts the described behavior of arbitrary file deletion via unlink(). File deletion has no inherent confidentiality impact; the correct impact metrics should reflect Integrity and Availability loss. This discrepancy should be flagged to the reporter (VulnCheck) and NVD for correction. Setting that aside: attack complexity is genuinely low once a user obtains media management rights, and the blast radius of deleting arbitrary files - including configuration files, CMS user databases, or web server files - is severe. No KEV listing and no POC are confirmed, so real-world exploitation risk is currently opportunistic rather than mass-exploitation. Organizations where media management rights are delegated broadly (editors, content contributors) face the highest exposure. |
| Exploit ScenarioDerived | An attacker with a low-privileged Grav account that has media management permissions submits a file deletion request with a filename containing directory traversal sequences, such as '../../user/accounts/admin.yaml'. The deleteFile() method passes this path to unlink(), deleting the administrator account file and potentially locking out all privileged users. No public POC has been identified, but the attack requires only standard HTTP requests with a crafted parameter value. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Arbitrary file deletion in Grav CMS before 2.0.16 allows authenticated users holding media management permissions to delete files anywhere on the server filesystem via path traversal sequences in filenames passed to MediaUploadTrait::deleteFile(). The root cause is that deleteFile() validates only the basename of a supplied filename while passing the full, unvalidated path - including ../ sequences - directly to PHP's unlink(). No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity makes this straightforward to weaponize for any user who holds media upload/delete rights.
RemediationAI
Upgrade Grav CMS to version 2.0.16 or later, which is the vendor-released patch addressing this vulnerability per GHSA-jq29-c7v8-rg55 (https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55). If immediate upgrade is not feasible, restrict media management permissions to only highly trusted administrator accounts and audit current role assignments to ensure no low-trust users hold delete rights. As an additional compensating control, configure operating-system-level file permissions so that the PHP process user can only write and delete within the intended media directories (e.g. chown and chmod restrictions on user/pages and images directories), reducing the blast radius of a traversal even if the PHP code path is triggered. Note that restricting permissions at the OS layer may affect legitimate CMS functionality such as plugin installation and cache clearing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Grav is a flat-file PHP CMS (CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) that manages media through a MediaUploadTrait used across content-editing contexts. CWE-22 (Path Traversal) describes the root cause: the application splits the attacker-supplied filename into dirname and basename components, validates only the basename, then reconstructs and passes the full path to unlink(). Supplying a value such as '../../config/security.yaml' causes the basename check to pass (the basename 'security.yaml' may look benign) while the preserved directory traversal causes unlink() to operate outside the intended media storage root. This is a classic insufficient path normalization flaw in PHP file management code.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network vector and low complexity confirmed; PR:L for required media-manager credentials; file deletion drives I:H and A:H with no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Grav CMS before version 2.0.16 contains an arbitrary file deletion vulnerability accessible to any staff member or administrator assigned media management permissions, creating risk of critical data loss and potential application compromise. Organizations running vulnerable instances should immediately audit permission assignments and implement protective controls to prevent exploitation by authorized or compromised internal accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict media management role to administrative users with demonstrable need only; deploy OS-level file access controls to prevent deletion outside intended media directories; configure monitoring and alerting on file deletion events in application and data paths; maintain verified backups and test recovery procedures weekly; consider disabling media upload functionality if operationally feasible; subscribe to Grav CMS security advisories to detect patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Grav CMS Access Control and Traversal Flaws
View all 9Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB