CVE-2026-72697: Grav CMS Path Traversal Vulnerability

CVE-2026-72697 Overview

CVE-2026-72697 is a path traversal vulnerability [CWE-22] in Grav CMS versions prior to 2.0.16. The flaw resides in the media_directory() Twig function, which fails to validate filesystem paths supplied by page authors. Authenticated users with page authoring privileges can pass arbitrary filesystem paths to the function and combine it with the allow-listed filepath accessor on Medium objects. This lets attackers enumerate directories and read file contents outside the intended media scope, provided the files match configured media extensions and the web server process can access them.

Critical Impact
Authenticated attackers can read arbitrary files on the host that match configured media extensions, exposing sensitive server-side content.

Affected Products

Grav CMS versions prior to 2.0.16
Deployments using the media_directory() Twig function in page templates
Grav instances that permit authenticated page authoring

Discovery Timeline

2026-08-25 - CVE-2026-72697 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-72697

Vulnerability Analysis

Grav CMS exposes a media_directory() Twig function that returns a collection of Medium objects representing files in a configured directory. The function does not validate or constrain the filesystem path argument to the Grav media root. An authenticated user with page authoring rights can invoke the function with any absolute or relative filesystem path.

Each returned Medium object exposes an allow-listed filepath accessor. Combined with standard Twig iteration, this accessor lets the author read files anywhere the PHP process has permission, so long as the extension matches the CMS media whitelist. The vulnerability breaks the intended isolation between page content and server filesystem access.

Root Cause

The root cause is missing path canonicalization and containment enforcement in the media_directory() implementation. The function accepts author-controlled input without normalizing traversal sequences or confirming the resolved path stays within the Grav user/pages media hierarchy. This is a classic path traversal weakness [CWE-22].

Attack Vector

An authenticated user with page authoring privileges edits or creates a page containing Twig markup that calls media_directory() with a target path such as a system configuration directory. The attacker iterates the returned Medium collection and dereferences the filepath property to read file contents through the rendered page. The attack is network-reachable and requires only low-privileged authenticated access. See the GitHub Security Advisory GHSA-47ch-6w46-6xm7 and the VulnCheck Advisory on Grav CMS for further technical details.

Detection Methods for CVE-2026-72697

Indicators of Compromise

Twig templates or page content invoking media_directory() with paths outside user/pages/
Page revisions authored by non-administrative users that reference absolute filesystem paths
Web server access logs showing unusual page renders returning content that matches system file signatures
Unexpected read access to files such as configuration YAML or .env files matching configured media extensions

Detection Strategies

Audit the Grav user/pages directory and page database for Twig calls to media_directory() referencing non-standard paths
Correlate authenticated author sessions with subsequent page renders that expose file contents
Review Grav admin plugin audit logs for page create and edit events by low-privileged accounts

Monitoring Recommendations

Enable and centralize Grav application logs alongside web server access logs
Alert on Twig rendering errors or unexpected file paths surfaced in rendered HTML
Monitor filesystem access by the PHP-FPM or web server user to sensitive directories outside the web root

How to Mitigate CVE-2026-72697

Immediate Actions Required

Upgrade Grav CMS to version 2.0.16 or later without delay
Restrict page authoring privileges to trusted administrative accounts only
Review recent page revisions for malicious media_directory() usage and revert suspicious changes
Rotate any credentials or secrets stored in files that authenticated authors may have accessed

Patch Information

The vulnerability is fixed in Grav CMS 2.0.16. Refer to the GitHub Security Advisory GHSA-47ch-6w46-6xm7 for the patch commit and release notes. Apply the update through the Grav admin panel or via the standard CLI upgrade path.

Workarounds

Remove or disable page authoring access for untrusted users until the patch is applied
Run the web server process under a least-privilege account that cannot read sensitive system files
Use filesystem access controls to deny the PHP process read access to directories outside the Grav installation

bash

# Configuration example
# Upgrade Grav CMS to the patched release
cd /var/www/grav
php bin/gpm selfupgrade
php bin/gpm update

# Verify installed version is 2.0.16 or later
php bin/grav --version