CVE-2026-85603: Grav Admin Plugin Path Traversal Flaw

CVE-2026-85603 Overview

CVE-2026-85603 is a path traversal vulnerability [CWE-73] in the Grav flat-file content management system (CMS). Versions before 1.10.55 fail to validate the language code parameter in the admin plugin's Save As action. An authenticated administrator with the admin.pages.create permission can supply directory traversal sequences in the lang POST field. This allows writing arbitrary .md files outside the intended pages directory with attacker-controlled content.

Critical Impact

An authenticated admin user can write arbitrary Markdown files to locations outside the Grav pages directory, enabling content tampering, potential site defacement, and downstream code execution if written files intersect with executable code paths.

Affected Products

• Grav CMS versions prior to 1.10.55
• Grav Admin Plugin (Save As action handler)
• Deployments granting the admin.pages.create permission to non-trusted users

Discovery Timeline

• 2026-09-04 - CVE-2026-85603 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85603

Vulnerability Analysis

The flaw resides in the Grav admin plugin handler for the Save As action. The endpoint accepts a lang POST parameter that identifies the target language for the saved page. The plugin uses this value to construct the output file path without normalizing or validating traversal sequences. Because the lang value flows directly into filesystem path construction, an attacker can inject ../ sequences to escape the pages directory. The written content is a Markdown file with attacker-supplied body data, which the attacker also controls through the same request.

Exploitation requires authenticated access with the admin.pages.create role. This raises the barrier to exploitation but does not eliminate risk in multi-tenant editorial environments or where content editor accounts are provisioned broadly. The vulnerability is categorized under CWE-73: External Control of File Name or Path.

Root Cause

The root cause is missing input validation on the lang POST field within the Save As workflow. The admin plugin trusts the client-supplied language code and concatenates it into the filesystem destination. No canonicalization, allowlist check, or containment check against the pages base directory is enforced before the write.

Attack Vector

The attack vector is network-based over HTTP. An authenticated attacker sends a crafted POST request to the admin Save As endpoint with directory traversal sequences in the lang field and arbitrary Markdown content in the body. The server writes the file at the traversed location. Refer to the GitHub Security Advisory GHSA-h9g9-73c3-23c9 and the VulnCheck Path Traversal Advisory for the request structure.

Detection Methods for CVE-2026-85603

Indicators of Compromise

• Presence of unexpected .md files outside the configured user/pages/ directory tree
• HTTP POST requests to Grav admin Save As endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the lang parameter
• Admin audit log entries showing Save As actions with abnormal or non-standard language codes
• Recently modified files in user/config/, user/plugins/, or webroot directories that were not authored through normal workflows

Detection Strategies

• Inspect web server access logs for POST requests to admin routes containing traversal patterns in the lang parameter
• Enable file integrity monitoring on the Grav installation directory to alert on .md file creation outside user/pages/
• Review admin plugin audit trails for Save As operations correlated with the admin.pages.create role

Monitoring Recommendations

• Alert on any filesystem write to Grav configuration or plugin directories originating from the web server user
• Baseline the list of valid language codes and flag admin operations submitting values outside the allowlist
• Correlate admin session activity with file creation events to identify anomalous editorial behavior

How to Mitigate CVE-2026-85603

Immediate Actions Required

• Upgrade Grav to version 1.10.55 or later where the lang parameter is validated
• Audit accounts holding the admin.pages.create permission and revoke access for non-essential users
• Review the Grav installation for unauthorized .md files created outside the pages directory
• Rotate admin credentials if compromise is suspected

Patch Information

The fix is available in Grav 1.10.55. The patched version enforces validation on the lang POST parameter in the admin Save As action, rejecting values containing directory traversal sequences or characters outside the expected language code format. Upgrade instructions and full patch context are available in the GitHub Security Advisory.

Workarounds

• Restrict admin.pages.create permission to trusted administrators only until the upgrade is applied
• Place the Grav admin interface behind an IP allowlist or VPN to limit exposure
• Deploy a web application firewall (WAF) rule blocking POST requests to admin routes where the lang parameter contains ../, ..\, or encoded traversal variants
• Enforce filesystem permissions so the web server user cannot write outside user/pages/

# Example WAF rule (ModSecurity) to block traversal in the lang parameter
SecRule ARGS:lang "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
    "id:1085603,phase:2,deny,status:403,\
    msg:'CVE-2026-85603 Grav admin lang traversal attempt'"