CVE-2026-72695: Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Q: Who can exploit this issue?

An attacker must be authenticated and have media management permissions in Grav. The vulnerability is remotely reachable and does not require user interaction.

Q: What is the practical impact of successful exploitation?

An authorized attacker can supply directory traversal sequences in a filename and cause deletion of arbitrary files outside the intended media storage directory. The reported impact affects integrity and availability; no confidentiality impact is identified.

Q: Which versions are affected?

Grav versions before 2.0.16 are affected. Upgrading to 2.0.16 or later addresses the affected version range described in the advisory.

Published Aug 25, 2026

Updated

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

Affected Software

1 affected component

Grav Grav<2.0.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav to a version that resolves this vulnerability.
Fixed in 2.0.16
Compensating control
Limit access to MediaUploadTrait media/file management functions so only trusted administrative users with the required media management permissions can use them.

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have media management permissions in Grav. The vulnerability is remotely reachable and does not require user interaction.

What is the practical impact of successful exploitation?

An authorized attacker can supply directory traversal sequences in a filename and cause deletion of arbitrary files outside the intended media storage directory. The reported impact affects integrity and availability; no confidentiality impact is identified.

Which versions are affected?

Grav versions before 2.0.16 are affected. Upgrading to 2.0.16 or later addresses the affected version range described in the advisory.

CVE-2026-72695: Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of successful exploitation?

Which versions are affected?