CVE-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55
https://www.vulncheck.com/advisories/grav-before-path-traversal-via-mediauploadtrait-deletefile
https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Grav anterior a la versión 2.0.16 contiene una vulnerabilidad de salto de ruta en MediaUploadTrait::deleteFile() que permite a usuarios autenticados con permisos de gestión de medios eliminar archivos arbitrarios al proporcionar nombres de archivo con secuencias de salto de directorio. El método valida solo la porción del nombre base del archivo mientras conserva rutas de directorio no validadas que contienen secuencias ../ que se pasan a unlink(), lo que permite la eliminación de archivos fuera del directorio de almacenamiento de medios previsto.

Information

Published : 2026-08-25 02:16

Updated : 2026-10-12 15:10

NVD link : CVE-2026-72695

Mitre link : CVE-2026-72695

CVE.ORG link : CVE-2026-72695

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-72695", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72695", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T17:38:00.813215Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "getgrav", "product": "grav", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.16", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.16", "versionType": "semver"}], "packageURL": "pkg:composer/getgrav/grav", "defaultStatus": "unaffected"}]}], "published": "2026-08-25T02:16:45.097", "references": [{"url": "https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/grav-before-path-traversal-via-mediauploadtrait-deletefile", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory."}, {"lang": "es", "value": "Grav anterior a la versi\u00f3n 2.0.16 contiene una vulnerabilidad de salto de ruta en MediaUploadTrait::deleteFile() que permite a usuarios autenticados con permisos de gesti\u00f3n de medios eliminar archivos arbitrarios al proporcionar nombres de archivo con secuencias de salto de directorio. El m\u00e9todo valida solo la porci\u00f3n del nombre base del archivo mientras conserva rutas de directorio no validadas que contienen secuencias ../ que se pasan a unlink(), lo que permite la eliminaci\u00f3n de archivos fuera del directorio de almacenamiento de medios previsto."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}