Grav CMS CVE-2026-78851

Requires an authenticated low-privilege session (PR:L) with the ability to reach or influence the mediaDirFunc Twig function exposed by GravExtension.php, then supply a crafted path containing traversal sequences to escape the intended media directory and read arbitrary sensitive files. Applies to Grav CMS versions 2.0.3 through 2.0.6. Limiting factors: exploitation is gated by authentication and by access to template/Twig-rendering functionality (the security.yaml reference at line 325 indicates a function-access control surface), so it is not exploitable by fully unauthenticated users against a default locked-down configuration; impact is confined to confidentiality (file disclosure) with no write or availability effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity information-disclosure flaw requiring low-level authentication (PR:L) with no user interaction, high confidentiality impact and no integrity/availability impact - consistent with a directory-traversal file read via the GravExtension.php mediaDirFunc Twig method. Exploitation maturity is modest: a public proof-of-concept repository (SLO-CYBER-SEC/CVE-2026-78851) indicates publicly available exploit code exists, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. There is no SSVC decision data in the input. Net assessment: this is a medium-severity, authentication-gated read primitive - a genuine but bounded risk rather than a drop-everything priority, because the PR:L requirement and MEDIUM base score limit it to attackers who already hold some authenticated foothold. Note a data-confidence caveat: the CVSS vector and description agree on a network/authenticated read, but the CPE and EUVD 'affected versions' fields are populated with 'n/a' placeholders rather than the 2.0.3-2.0.6 range in the description - verify affected-version scope against the vendor.

An attacker holding a low-privileged authenticated account (or any role able to influence Twig template rendering) invokes the mediaDirFunc function with a path containing traversal sequences, causing Grav to resolve a path outside the intended media directory and return the contents of a sensitive file such as a configuration or credential file. A public proof-of-concept exists, lowering the effort required. Because the CVSS vector is AV:N/AC:L, the request is a straightforward remote HTTP interaction with no special timing or complexity.