CVE-2026-75830: grav-plugin-api before 1.0.15 Path Traversal via batchCopy
grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getgrav/grav-plugin-apito a version that resolves this vulnerability.Fixed in 1.0.15 - Operational
Review and remediate any pages or files that an attacker may have written via path traversal through PagesController::batchCopy() (POST /api/v1/pages/batch) before upgrading to grav-plugin-api 1.0.15.
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires an authenticated account with the api.pages.write permission. This is available to editor-level users and does not require super-admin access.
Which versions are affected and which version fixes it?
Affected deployments are grav-plugin-api versions from 1.0.0-beta.10 through 1.0.14, inclusive. Version 1.0.15 fixes the issue.
What can successful exploitation do?
An attacker can submit traversal sequences in the suffix field of POST /api/v1/pages/batch. This can cause attacker-controlled page content and media to be written outside the intended user/pages/ directory, to filesystem locations writable by the web server process.