CVE-2026-72697: Grav CMS before 2.0.16 Path Traversal via media_directory
Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to mediadirectory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav CMSto a version that resolves this vulnerability.Fixed in 2.0.16 - Compensating control
If you cannot immediately upgrade Grav, restrict web access so that only trusted users have page authoring privileges (since attackers with page authoring privileges can exploit media_directory() path traversal).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access with page authoring privileges. They must be able to supply input to the media_directory() Twig function.
What files could be exposed?
The attacker may read files outside the intended media scope if the files match configured media extensions and are readable by the web server process. The issue is limited to file disclosure; no integrity or availability impact is described.
Are default installations affected?
The provided information does not establish whether a default configuration is affected. Exposure depends on page authoring access, use of media_directory(), configured media extensions, and filesystem permissions of the web server process.
How can I reduce risk before upgrading?
Restrict page authoring privileges to trusted users and review where media_directory() can receive user-controlled paths. Limit the web server process's read permissions and configured media extensions to reduce the files that could be disclosed.