{"uuid": "c7ab6a3b-eda4-4895-98c4-b7bfccf7ce81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72695", "type": "seen", "source": "https://gist.github.com/alon710/424c5810a1f7a2ef19ef90cac7c85184", "content": "# CVE-2026-72695: CVE-2026-72695: Authenticated Path Traversal and Arbitrary File Deletion in Grav CMS MediaUploadTrait\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72695\n\n## Summary\nA path traversal vulnerability exists in Grav CMS versions prior to 2.0.16. The flaw occurs within the file validation mechanisms of the MediaUploadTrait, enabling authenticated users with media management privileges to bypass sandbox limitations. This allows the deletion of arbitrary files on the filesystem, which can result in denial of service or remote code execution.\n\n## TL;DR\nAn authenticated path traversal vulnerability in Grav CMS before 2.0.16 allows media administrators to delete arbitrary files on the system by bypassing incomplete directory validation checks in the MediaUploadTrait.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22: Improper Limitation of a Pathname to a Restricted Directory\n- **Attack Vector**: Network (Unauthenticated: No, Requires authenticated media management privileges)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **EPSS Score**: 0.00567 (Percentile: 45.53%)\n- **Impact**: Arbitrary File Deletion / Denial of Service / Remote Code Execution\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Grav CMS installations prior to version 2.0.16\n- Plugins incorporating system/src/Grav/Common/Media/Traits/MediaUploadTrait.php\n- **Grav CMS**: < 2.0.16 (Fixed in: `2.0.16`)\n\n## Mitigation\n\n- Upgrade Grav CMS to version 2.0.16 or newer.\n- Enforce strict filesystem permissions restricting write access to configuration folders.\n- Implement WAF rules targeting directory traversal sequences in media endpoints.\n- Restrict administrative media management permissions using role-based access control.\n\n**Remediation Steps:**\n1. Identify vulnerable Grav installations running versions prior to 2.0.16.\n2. Download the updated Grav CMS core package or execute the command-line update tool 'bin/gpm self-upgrade'.\n3. Verify the integration of commit f6883ed50764cb7dea41f9260e096374b4e17aeb in the codebase.\n4. Check third-party plugins utilizing MediaUploadInterface to ensure they inherit the updated traits.\n\n## References\n\n- [GitHub Security Advisory GHSA-jq29-c7v8-rg55](https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/grav-before-path-traversal-via-mediauploadtrait-deletefile)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-72695)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72695) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T03:31:25.434230Z"}