Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-78851 Overview
CVE-2026-78851 is a directory traversal vulnerability [CWE-22] affecting Grav CMS versions 2.0.3 through 2.0.6. The flaw resides in the mediaDirFunc method within GravExtension.php, a Twig extension component. A remote attacker with low privileges can traverse directories outside the intended media path and read sensitive files on the host system. The issue carries a CVSS 3.1 base score of 6.5 and primarily impacts confidentiality.
Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the Grav CMS process, exposing configuration data, credentials, and application source code.
Affected Products
- Grav CMS 2.0.3
- Grav CMS 2.0.4, 2.0.5
- Grav CMS 2.0.6
Discovery Timeline
- 2026-10-15 - CVE-2026-78851 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-78851
Vulnerability Analysis
The vulnerability stems from insufficient path sanitization in the mediaDirFunc method of GravExtension.php. This method is exposed as a Twig function and accepts a directory path argument used to enumerate media files. Because the input path is not constrained to the intended media root, attackers can supply traversal sequences such as ../ to escape the sandboxed directory.
Grav CMS exposes Twig templating to authenticated users and administrators. An attacker with access to template rendering functionality can invoke the vulnerable function with crafted input. The result is unauthorized access to files outside the designated media directory, including the user/config tree and system configuration files.
The weakness aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Grav's security.yaml configuration defines allowed paths, but the mediaDirFunc handler does not enforce those restrictions before resolving the filesystem path. See the Grav Twig Extension source file for the affected implementation.
Root Cause
The mediaDirFunc method accepts a user-controlled path parameter and passes it to filesystem operations without validating that the resolved path remains inside the Grav media root. The absence of canonicalization checks allows ../ traversal sequences to resolve outside the intended directory boundary.
Attack Vector
Exploitation requires network access and low-privileged authentication. An attacker invokes the vulnerable Twig function through template rendering with a traversal payload supplied as the directory argument. The server returns directory listings or file contents from locations outside the sanctioned media path. Refer to the public proof-of-concept repository for technical demonstration details.
Detection Methods for CVE-2026-78851
Indicators of Compromise
- HTTP requests to Grav admin or Twig rendering endpoints containing ../ or URL-encoded %2e%2e%2f sequences in parameters bound to mediaDirFunc.
- Web server access logs showing requests referencing paths outside the user/pages or user/media directories.
- Unexpected read access to user/config/system.yaml, .env, or /etc/passwd from the PHP worker process.
Detection Strategies
- Deploy web application firewall rules that reject path traversal sequences in parameters sent to Grav Twig rendering endpoints.
- Inspect PHP file access telemetry for the Grav process reading files outside its document root.
- Correlate authenticated session activity with abnormal file read patterns on the Grav host.
Monitoring Recommendations
- Enable verbose logging in Grav admin and audit Twig function invocations tied to authenticated accounts.
- Monitor filesystem audit logs for sensitive file access by the PHP-FPM or web server user.
- Alert on repeated 200 responses to requests containing encoded traversal patterns on Grav URLs.
How to Mitigate CVE-2026-78851
Immediate Actions Required
- Upgrade Grav CMS to a release later than 2.0.6 that remediates the mediaDirFunc path handling.
- Audit administrative and editor account access to Grav; revoke sessions for untrusted users.
- Review web server logs for prior exploitation attempts targeting Twig endpoints with traversal payloads.
Patch Information
No vendor advisory URL is listed in the NVD record at publication. Monitor the Grav project repository for releases addressing this CVE. Review the security.yaml configuration reference to confirm applied path restrictions after upgrading.
Workarounds
- Restrict access to the Grav admin interface using network ACLs or VPN gating until a patched version is deployed.
- Reduce the number of authenticated accounts that can author or render Twig templates.
- Place a reverse proxy filter in front of Grav that strips traversal sequences from query strings and POST bodies.
- Run the PHP worker under a least-privileged system account with filesystem permissions scoped to the Grav installation directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
