Grav CMS CVE-2026-85603

Exploitation requires an authenticated Grav admin session with the admin.pages.create permission explicitly granted. The vulnerable endpoint is the admin plugin's Save As action, reachable only through the Grav admin panel after login. The attacker must control the lang POST field in a Save As request; writes are constrained to files with a .md extension, limiting (but not eliminating) direct code execution depending on whether traversal-reachable directories contain PHP-parsed files. No special network conditions beyond HTTP/HTTPS access to the Grav admin interface are required. Non-admin users or admin users lacking the pages.create permission cannot trigger the vulnerability.

The CVSS 4.0 base score of 7.1 reflects a network-exploitable path (AV:N), low attack complexity (AC:L), and low-privilege requirement (PR:L). However, the provided CVSS 4.0 impact metrics (VC:H/VI:N) appear to invert the actual impact: the described vulnerability is a write primitive (integrity impact, VI:H), not a read/confidentiality disclosure - this discrepancy should be verified against the vendor advisory before using the vector for risk calculations. No EPSS score, CISA KEV listing, or public exploit code was provided; no public exploit has been identified at time of analysis. Real-world risk is moderate: the attack surface is restricted to admin users with a specific page-creation permission, which limits opportunistic exploitation. The primary danger is insider abuse or post-compromise persistence, where an attacker with stolen or maliciously granted admin credentials plants content that survives remediation.

An attacker holding a Grav admin account with admin.pages.create permission (or who has phished or stolen such credentials) sends a crafted POST request to the admin plugin's Save As endpoint with the lang field set to a traversal string such as '../../themes/quark'. Grav constructs the target path without sanitization and writes attacker-controlled Markdown content to the themes directory. If the traversal destination is later parsed by Grav's template engine in a way that executes embedded logic, the attacker achieves code execution on the next page render. No public exploit code has been identified at time of analysis.