CVE-2026-72695
Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 25, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 10, 2026
Description
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
gravgetgrav |
|
References
- GitHub Security Advisory (GHSA-jq29-c7v8-rg55)vendor-advisory
- VulnCheck Advisory: Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFilethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.