CVE-2026-72695: Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.16 - Compensating control
Limit access to MediaUploadTrait media/file management functions so only trusted administrative users with the required media management permissions can use them.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have media management permissions in Grav. The vulnerability is remotely reachable and does not require user interaction.
What is the practical impact of successful exploitation?
An authorized attacker can supply directory traversal sequences in a filename and cause deletion of arbitrary files outside the intended media storage directory. The reported impact affects integrity and availability; no confidentiality impact is identified.
Which versions are affected?
Grav versions before 2.0.16 are affected. Upgrading to 2.0.16 or later addresses the affected version range described in the advisory.