Description

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T12:17:24.040Z",
  "pubdate": "2026-09-04T12:17:24.040Z",
  "executiveSummary": "Grav versions prior to 1.10.55 are susceptible to a critical path traversal vulnerability residing within the admin plugin's 'Save As' functionality. This vulnerability stems from improper input validation of the 'lang' POST parameter, which allows an authenticated administrative user to bypass directory restrictions.\nBy injecting directory traversal sequences into the 'lang' field, an attacker can manipulate the file writing process to store arbitrary '.md' files in unauthorized locations outside of the intended 'pages' directory. This facilitates unauthorized file system modification and potentially remote code execution if sensitive system files or configuration files can be overwritten or created.\nSuccessful exploitation requires the attacker to possess an account with 'admin.pages.create' privileges, limiting the initial vector to authenticated internal or malicious administrative users. The vulnerability highlights a critical failure in sanitizing user-supplied input before it is passed to file system operations. Organizations utilizing affected versions of Grav are at significant risk of unauthorized content injection and system integrity compromise, necessitating immediate remediation to maintain a secure administrative environment.",
  "technicalDetails": "The vulnerability is classified as a Path Traversal (CWE-22) issue within the Grav admin plugin. The root cause is the lack of strict validation and normalization of the 'lang' parameter during the 'Save As' action execution. In standard operation, the admin plugin processes content updates and saves them to specific locations defined within the 'pages' directory structure. However, the input handler fails to verify that the 'lang' field—intended to specify the language of the content—does not contain filesystem traversal characters such as '../'.\nExploitation is achieved through a crafted POST request to the administrative interface. An authenticated user with 'admin.pages.create' permissions submits a request where the 'lang' parameter is modified to include sequences like '../../../../'. Because the application uses this parameter to construct the file save path without proper sanitization, the underlying PHP file operation effectively escapes the designated storage directory. This allows the attacker to specify a path relative to the application's root or other writable directories.\nThe attack flow follows a sequential process: First, the attacker initiates a 'Save As' action through the admin panel while intercepting or crafting a POST request. Second, the 'lang' parameter is substituted with a malicious path traversal payload. Third, the plugin processes the request, prepending or appending the attacker-controlled 'lang' string into the file path resolution logic. Fourth, the server writes the content provided in the request body to the absolute or relative path derived from the traversal sequence. Since the file is forced to be a '.md' file, the attacker is limited to files supported by the Markdown parser, but this is sufficient to overwrite configuration files or inject malicious content into sensitive areas of the web application.\nThis vulnerability is restricted to environments where the web server process has write permissions to locations outside the 'pages' directory. While the requirement for administrative authentication mitigates the risk from unauthenticated external threats, it poses a significant risk of privilege escalation or malicious activity by compromised or malicious administrative accounts. The failure to apply canonicalization techniques—such as 'realpath()' or strict regex-based validation of the 'lang' parameter—results in the ability to traverse the filesystem, allowing an attacker to achieve unauthorized file placement."
}