Grav CMS EUVD-2026-58634

Exploitation requires an authenticated Grav CMS account with 'profile editor' access - a high-privilege administrative role (PR:H in the provided CVSS 4.0 vector). The attacker must be able to create or modify backup profiles and trigger backup execution through the Grav admin interface. The web server process must have OS-level read permissions on the traversal target directory (e.g., /opt, /mnt, /srv) for sensitive files to be included in the archive. Grav's backup functionality must be enabled, which is typical in standard deployments. No non-default configuration is required beyond the attacker holding the profile editor role. Exploitation is limited by: the need for a high-privilege authenticated session, and the web server process's filesystem permissions determining which directories outside GRAV_ROOT are actually reachable.

The CVSS 4.0 score of 6.9 accurately reflects the primary constraint: exploitation requires PR:H (high privileges), meaning the attacker must already hold a Grav profile editor account. This substantially limits the realistic attack surface compared to unauthenticated flaws. The confidentiality impact is genuinely high (VC:H) - a successful traversal can expose credentials, configuration files, or application secrets from any directory readable by the web server process. No EPSS data was provided; KEV status is not confirmed; and no POC code has been identified, all of which suggest this has not seen broad opportunistic exploitation. The absence of integrity or availability impact (VI:N/VA:N) means this is a data-exposure risk rather than a full system-compromise vector. Real-world risk is elevated for deployments where the profile editor role is granted to multiple administrators or where compromised accounts are a realistic threat model; organizations with strict role separation and single-administrator Grav instances face lower residual risk.

An attacker who holds or has compromised a Grav account with profile editor privileges logs into the admin panel, navigates to the backup profile configuration, and sets the profile root path to a traversal string such as '../../opt/app-secrets'. After triggering a backup job, the attacker downloads the resulting archive and extracts files containing API keys, database credentials, or other sensitive data from outside GRAV_ROOT. No public proof-of-concept code has been identified at time of analysis, but the technique requires no specialized tooling beyond standard Grav admin access.