Description

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T12:19:32.960Z",
  "pubdate": "2026-08-18T12:19:32.960Z",
  "executiveSummary": "An authenticated path traversal vulnerability exists in the grav-plugin-api (getgrav/grav-plugin-api) package, specifically within the PagesController::batchCopy() method affecting versions 1.0.0-beta.10 through 1.0.14. This security flaw stems from an incomplete fix for GHSA-qjq4-jp55-4mx2, which fails to properly validate the user-controlled suffix parameter supplied via POST /api/v1/pages/batch.\nAn authenticated attacker possessing the api.pages.write permission at the editor-level can exploit this flaw by injecting path traversal sequences such as /../../../ into the vulnerable parameter. This enables the escape from the intended user/pages/ directory confinement.\nSuccessful exploitation allows the adversary to write attacker-controlled page content and page media to arbitrary filesystem locations that are writable by the underlying web server process. The risk implications include potential arbitrary file creation or overwriting within the server context. Remediation requires upgrading to version 1.0.15 where the vulnerability is officially resolved.",
  "technicalDetails": "The vulnerability resides in the PagesController::batchCopy() method within the grav-plugin-api package, impacting versions 1.0.0-beta.10 to 1.0.14. The root cause of the issue is an incomplete fix for a prior security advisory, designated as GHSA-qjq4-jp55-4mx2.\nDuring the batch copy operation invoked via POST /api/v1/pages/batch, the application processes a user-controlled suffix parameter intended for target destination manipulation. However, the input validation logic fails to sanitize or restrict path traversal sequences within this parameter. Consequently, an authenticated user capable of interacting with the API endpoint can inject directory traversal patterns such as /../../../.\nThe attack flow proceeds as follows: 1) The attacker authenticates and acquires an editor-level session with the api.pages.write permission. 2) The attacker constructs an HTTP POST request to the /api/v1/pages/batch endpoint containing malicious traversal sequences inside the suffix parameter. 3) The PagesController::batchCopy() method processes the unsanitized input and attempts to resolve the destination path. 4) The lack of bounds checking allows the path resolution mechanism to traverse outside the restricted user/pages/ directory. 5) The application writes attacker-controlled page content and page media to arbitrary filesystem locations accessible and writable by the web server process.\nThe post-exploitation impact is dictated by the filesystem permissions of the web server user, potentially leading to arbitrary file write conditions, application configuration tampering, or further systemic compromise depending on the targeted write locations."
}