A path traversal vulnerability in Grav allows low-privileged users to compromise arbitrary accounts by accessing sensitive configuration files, necessitating an immediate update.

This flaw is a path traversal vulnerability (CWE-22) triggered through the Frontmatter form. It allows an authenticated user with page editing privileges to bypass directory restrictions and read sensitive files, such as YAML account files containing hashed credentials and 2FA secrets.

The ability to access sensitive account data poses a severe threat to organizational security. An attacker can use the harvested password reset tokens or cracked password hashes to achieve full account takeover, potentially leading to unauthorized administrative access, data theft, or total system compromise. Given the CVSS score of 8.5, this high-severity vulnerability must be prioritized to prevent unauthorized access to the application backend.

Immediate Action: Upgrade the Grav installation to version 1.8.0-beta.27 or later, as this version contains the necessary security patch to remediate the path traversal flaw.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at the user account directory or attempts to access .yaml files via the Frontmatter interface.

Compensating Controls: If an immediate upgrade is not feasible, restrict access to the page editing functionality to trusted users only and implement strict egress filtering or WAF rules to detect and block path traversal patterns.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to the integrity and confidentiality of the Grav platform. Administrators should immediately verify their current version and apply the 1.8.0-beta.27 update. Failure to patch allows even low-privileged users to escalate their access, making remediation a high-priority task for security teams.