CVE-2026-78851: Grav Grav CMS vulnerability
Published Oct 15, 2026
·Updated
Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.
Affected Software
1 affected component
Grav Grav CMS>=2.0.3<=2.0.6
Event History
Oct 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
Which versions are affected?
Grav CMS versions 2.0.3 through 2.0.6 are identified as affected.
2
What access does an attacker need?
The issue is described as remotely exploitable. The available information does not state that authentication or prior access is required.
3
What is the impact of successful exploitation?
An attacker may obtain sensitive information by exploiting directory traversal involving GravExtension.php and the mediaDirFunc method.