Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Getgrav |
|
No data.
No data.
References
History
Fri, 04 Sep 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content. | |
| Title | Grav Admin Plugin Path Traversal via Save As Language Code | |
| First Time appeared |
Getgrav
Getgrav grav |
|
| Weaknesses | CWE-73 | |
| CPEs | cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Getgrav
Getgrav grav |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-09-04T11:30:04.799Z
Updated: 2026-09-04T11:30:04.799Z
Reserved: 2026-09-04T11:00:28.731Z
Link: CVE-2026-85603
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-09-04T12:17:24.040
Modified: 2026-09-08T20:05:53.177
Link: CVE-2026-85603
Redhat
No data.