CVE-2026-72697: Grav CMS before 2.0.16 Path Traversal via media_directory

Q: Who can exploit this issue?

An attacker needs authenticated access with page authoring privileges. They must be able to supply input to the media_directory() Twig function.

Q: What files could be exposed?

The attacker may read files outside the intended media scope if the files match configured media extensions and are readable by the web server process. The issue is limited to file disclosure; no integrity or availability impact is described.

Q: Are default installations affected?

The provided information does not establish whether a default configuration is affected. Exposure depends on page authoring access, use of media_directory(), configured media extensions, and filesystem permissions of the web server process.

Q: How can I reduce risk before upgrading?

Restrict page authoring privileges to trusted users and review where media_directory() can receive user-controlled paths. Limit the web server process's read permissions and configured media extensions to reduce the files that could be disclosed.

Published Aug 25, 2026

Updated

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to mediadirectory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.

Affected Software

1 affected component

Grav Grav CMS<2.0.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav CMS to a version that resolves this vulnerability.
Fixed in 2.0.16
Compensating control
If you cannot immediately upgrade Grav, restrict web access so that only trusted users have page authoring privileges (since attackers with page authoring privileges can exploit media_directory() path traversal).

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs authenticated access with page authoring privileges. They must be able to supply input to the media_directory() Twig function.

What files could be exposed?

The attacker may read files outside the intended media scope if the files match configured media extensions and are readable by the web server process. The issue is limited to file disclosure; no integrity or availability impact is described.

Are default installations affected?

The provided information does not establish whether a default configuration is affected. Exposure depends on page authoring access, use of media_directory(), configured media extensions, and filesystem permissions of the web server process.

How can I reduce risk before upgrading?

Restrict page authoring privileges to trusted users and review where media_directory() can receive user-controlled paths. Limit the web server process's read permissions and configured media extensions to reduce the files that could be disclosed.

CVE-2026-72697: Grav CMS before 2.0.16 Path Traversal via media_directory

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What files could be exposed?

Are default installations affected?

How can I reduce risk before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What files could be exposed?

Are default installations affected?

How can I reduce risk before upgrading?