CVE-2026-85603: Grav Admin Plugin Path Traversal via Save As Language Code
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 1.10.55 - Configuration
Ensure the Save As action validates the lang POST field (language code) and rejects/normalizes directory traversal sequences so it cannot write .md files outside the pages directory.
Grav Admin Plugin (Save As action) lang POST field (language code) validation = Disallow directory traversal sequences
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Grav admin user with the admin.pages.create permission. Unauthenticated users and accounts without that permission are not described as able to exploit it.
What does an attacker need to submit?
The attacker must use the admin plugin's Save As action and provide directory-traversal sequences in the lang POST parameter. This can cause attacker-controlled .md content to be written outside the pages directory.
Which installations are affected?
Grav versions before 1.10.55 are affected. The issue is in the admin plugin's Save As action.