medium
5.5
CWE
22 352
Advisory Published
Advisory Published
Updated

CVE-2020-29556: Path Traversal

First published: Mon Mar 15 2021(Updated: )

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Getgrav Grav Cms<1.7.0
Getgrav Grav Cms=1.7.0-beta1
Getgrav Grav Cms=1.7.0-beta10
Getgrav Grav Cms=1.7.0-beta2
Getgrav Grav Cms=1.7.0-beta3
Getgrav Grav Cms=1.7.0-beta4
Getgrav Grav Cms=1.7.0-beta5
Getgrav Grav Cms=1.7.0-beta6
Getgrav Grav Cms=1.7.0-beta7
Getgrav Grav Cms=1.7.0-beta8
Getgrav Grav Cms=1.7.0-beta9
Getgrav Grav Cms=1.7.0-rc1
Getgrav Grav Cms=1.7.0-rc10
Getgrav Grav Cms=1.7.0-rc11
Getgrav Grav Cms=1.7.0-rc12
Getgrav Grav Cms=1.7.0-rc13
Getgrav Grav Cms=1.7.0-rc14
Getgrav Grav Cms=1.7.0-rc15
Getgrav Grav Cms=1.7.0-rc16
Getgrav Grav Cms=1.7.0-rc17
Getgrav Grav Cms=1.7.0-rc2
Getgrav Grav Cms=1.7.0-rc20
Getgrav Grav Cms=1.7.0-rc3
Getgrav Grav Cms=1.7.0-rc4
Getgrav Grav Cms=1.7.0-rc5
Getgrav Grav Cms=1.7.0-rc6
Getgrav Grav Cms=1.7.0-rc7
Getgrav Grav Cms=1.7.0-rc8
Getgrav Grav Cms=1.7.0-rc9
composer/getgrav/grav<1.6.30
1.6.30
composer/getgrav/grav>=1.7.0-beta.1<=1.7.0-rc.17

Remedy

https://blog.bssi.fr/cve-2020-29553-cve-2020-29555-cve-2020-29556-multiple-vulnerabilities-within-cms-grav/

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2020-29556?

    CVE-2020-29556 is a vulnerability in Grav CMS that allows an authenticated attacker to read arbitrary local files on the underlying server.

  • How severe is CVE-2020-29556?

    CVE-2020-29556 has a severity rating of 5.5 (medium).

  • Who is affected by CVE-2020-29556?

    Users of Grav CMS versions up to 1.7.0-rc.17 are affected by CVE-2020-29556.

  • Is authentication required to exploit CVE-2020-29556?

    Yes, authentication is required to exploit CVE-2020-29556.

  • Is there a fix available for CVE-2020-29556?

    A fix for CVE-2020-29556 may be available in the latest version of Grav CMS. It is recommended to update to the latest version to mitigate this vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203