Grav Plugin API CVE-2026-75830

Exploitation requires a valid authenticated session with the api.pages.write permission assigned, which is an editor-level role and not restricted to super-administrators - any contributor account granted page editing via the API is a potential threat actor. The grav-plugin-api plugin must be installed and enabled, and the /api/v1/pages/batch endpoint must be network-reachable. The version must fall within 1.0.0-beta.10 through 1.0.14 inclusive. Impact is bounded by the write permissions of the web server process: directories with strict OS-level permissions (e.g., owned by root with no web server write access) will resist traversal writes, limiting the effective impact radius. No unauthenticated exploitation path is indicated by the CVSS PR:L metric.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L reflects a network-accessible, low-complexity attack requiring only editor-level credentials - a meaningful real-world threat wherever untrusted contributors hold api.pages.write permissions. The high integrity impact (VI:H) accurately represents an arbitrary filesystem write primitive bounded only by web server process permissions. The low availability signal (VA:L) accounts for potential overwrite of application files. No EPSS data was provided in the source intelligence, preventing probabilistic exploitation comparison, and the absence of a CISA KEV listing or confirmed public exploit code moderates immediate urgency; however, the incomplete-fix lineage makes independent reproduction technically straightforward, and even a mid-sized municipal IT team in boleslawiec running a Grav-based public portal with multiple contributor accounts should treat this as urgent given how easily editor trust can be abused. The narrow exploitation prerequisite - authenticated editor access - is the primary real-world friction point.

An attacker with a valid editor-level account sends a POST request to /api/v1/pages/batch with a suffix value such as /../../../var/www/html/backdoor.md, causing the batchCopy() method to write attacker-controlled Markdown content to a web-accessible path outside the intended pages directory. No public exploit code is confirmed, but the traversal mechanism is straightforward given the incomplete-fix history and the simplicity of path manipulation in POST parameters. If the web server process has write access to directories serving executable content or configuration files, the impact could escalate beyond content injection.