CVE-2026-72695: Grav CMS Path Traversal Vulnerability

CVE-2026-72695 Overview

CVE-2026-72695 is a path traversal vulnerability in Grav, an open-source flat-file content management system (CMS). Versions before 2.0.16 contain flawed input validation in the MediaUploadTrait::deleteFile() method. Authenticated users with media management permissions can supply filenames containing directory traversal sequences to delete arbitrary files on the host filesystem. The affected method validates only the basename portion of the supplied filename while passing the unvalidated directory path directly to unlink(). The weakness is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can delete files outside the intended media directory, enabling site tampering, denial of service, or removal of security-relevant files.

Affected Products

Grav CMS versions prior to 2.0.16
Grav installations exposing the media management interface to non-administrative editors
Grav-based sites where content editors or contributors have media upload permissions

Discovery Timeline

2026-08-25 - CVE-2026-72695 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-72695

Vulnerability Analysis

The vulnerability resides in the MediaUploadTrait::deleteFile() method used by Grav to remove uploaded media assets. When a delete request is processed, the method extracts the filename parameter and applies validation logic to the basename component only. The directory portion of the path, including any ../ traversal sequences, is preserved and concatenated when the file removal call is issued.

Because unlink() is invoked against the composed path, an authenticated user with media permissions can target any file readable and writable by the PHP process. Impact includes deletion of Grav configuration files, user account files stored in user/accounts/, page content in user/pages/, cached compiled templates, and system files outside the webroot. Loss of these files can result in site defacement, authentication bypass through account file removal, or full application unavailability.

Root Cause

The root cause is incomplete path sanitization. The validation routine assumes the incoming filename is a leaf name and only checks the basename against allowed characters and extensions. Directory separators and .. segments in the original input are not stripped or rejected before the final path is constructed. This creates a canonical example of CWE-22, where controlled input reaches a filesystem sink without normalization against a fixed base directory.

Attack Vector

Exploitation requires an authenticated session with media management privileges. The attacker issues a delete request through the media API and supplies a filename value containing ../ sequences pointing to a target file outside the media root. Because the request is network-reachable and requires only low privileges, any editor-level account is sufficient. No user interaction is required beyond the attacker's own action.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-jq29-c7v8-rg55 and the VulnCheck Advisory on Grav for the vendor's technical description.

Detection Methods for CVE-2026-72695

Indicators of Compromise

Media delete requests whose filename parameters contain ../, ..\\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences.
Unexpected removal of files under user/accounts/, user/config/, user/pages/, or system/ outside normal administrative activity.
Grav admin audit log entries showing media delete actions performed by non-administrative accounts against unusual paths.

Detection Strategies

Inspect web server access logs for POST or DELETE requests to Grav media endpoints containing traversal patterns in the request body or query string.
Correlate PHP unlink() filesystem telemetry with Grav process activity to identify deletions targeting paths outside the configured media directory.
Alert when Grav content files disappear without a corresponding administrative session in the Grav admin plugin log.

Monitoring Recommendations

Enable file integrity monitoring on the Grav installation directory, with priority on user/accounts/, user/config/, and system/config/.
Forward web server and PHP-FPM logs to a centralized analytics platform and build detections for encoded traversal patterns against /admin/media routes.
Review authenticated user roles regularly and monitor for privilege changes to accounts with media permissions.

How to Mitigate CVE-2026-72695

Immediate Actions Required

Upgrade Grav to version 2.0.16 or later, which contains the corrected filename validation in MediaUploadTrait::deleteFile().
Audit Grav user accounts and remove media management permissions from users who do not require them.
Review recent media delete activity in the admin log and confirm no unauthorized file removals occurred prior to patching.

Patch Information

Grav 2.0.16 introduces stricter validation that rejects filenames containing directory separators or traversal segments before the path is passed to unlink(). Administrators should apply the update through the Grav admin panel, Composer, or by replacing the release archive. See the GitHub Security Advisory GHSA-jq29-c7v8-rg55 for the fix commit reference.

Workarounds

Restrict access to the Grav admin interface using network controls such as IP allowlisting or a VPN until the patch is applied.
Temporarily revoke media management permissions from all non-administrative roles.
Configure the PHP process to run with least-privilege filesystem permissions so that traversal targets outside the webroot are not writable.

bash

# Upgrade Grav via CLI to the patched release
cd /path/to/grav
php bin/gpm selfupgrade
php bin/gpm update grav
# Verify installed version is 2.0.16 or later
php bin/grav --version