Description

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-14T12:16:45.003Z",
  "pubdate": "2026-08-14T12:16:45.003Z",
  "executiveSummary": "Grav versions before 2.0.13 suffer from an improper path validation vulnerability within the backup profile root path configuration mechanism. This security flaw allows malicious actors possessing profile editor access to configure backup profiles incorporating directory traversal sequences, bypassing standard boundaries defined by GRAV_ROOT.\nThe primary impact of this vulnerability is unauthorized information disclosure, enabling attackers to archive and subsequently access sensitive system directories and files located outside the web root, such as those within /opt, /mnt, or /srv, provided they are not explicitly blocked by the hard-coded deny-list.\nThe risk implications are critical for systems running vulnerable versions of the Grav CMS, as privilege escalation from application-level profile management to broader filesystem enumeration becomes feasible. Exploitation specifically requires authenticated access with profile editor permissions to manipulate the backup profile configurations, after which the archiving engine processes the traversal paths during backup generation routines.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and path validation in backup profile root path handling prior to Grav version 2.0.13. When defining the root path for a backup profile, the application fails to adequately restrict directory traversal sequences like dot-dot-slash (../) combinations when referencing locations outside the designated GRAV_ROOT directory.\nThe vulnerable component is the backup profile configuration and execution module within Grav. The application relies on a hard-coded deny-list to block certain sensitive paths, but paths not explicitly cataloged in this deny-list can be successfully traversed and targeted for archiving if they reside in accessible system partitions such as /opt, /mnt, or /srv.\nExploitation requires authenticated access with profile editor privileges. The attack flow proceeds as follows: First, an authenticated attacker with profile editing capabilities crafts or modifies an existing backup profile configuration, injecting path traversal sequences into the root path parameter. Second, the attacker initiates the backup generation process through the administrative interface or API. Third, the backend archiving engine processes the maliciously configured profile, resolving the traversal paths outside of GRAV_ROOT. Fourth, the system generates an archive containing the targeted sensitive files from locations like /opt, /mnt, or /srv. Finally, the attacker downloads or accesses the resulting backup archive, achieving unauthorized extraction of sensitive system data.\nThe network exposure depends on the administrative interface accessibility of the Grav CMS instance. Payload behavior involves reading arbitrary filesystem locations permitted by the underlying operating system user permissions running the web application, circumventing application-layer containment boundaries. Post-exploitation impact is characterized by the potential exposure of credentials, configuration files, and system data stored in external directories."
}