Grav CMS is susceptible to a path traversal vulnerability that could allow an unauthenticated attacker to read sensitive files on the underlying host system.

This is a path traversal vulnerability (CWE-22) that occurs when user-supplied input is not properly sanitized before being used in file system operations, specifically within the watermark functionality. An unauthenticated attacker can manipulate the path to traverse directories and access files outside of the intended directory.

Successful exploitation allows an attacker to retrieve sensitive configuration files, source code, or other restricted data stored on the web server. This unauthorized access can lead to complete system compromise or information disclosure, justifying the high severity CVSS score of 7.5.

Immediate Action: Update Grav CMS to version 2.0.11 or later to implement the necessary path sanitization fixes.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the watermark or image processing modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block requests containing malicious path traversal sequences before they reach the application.

Public Exploit Available: Unknown

Due to the existence of a proof-of-concept and the high risk of information disclosure, administrators must prioritize updating to Grav CMS version 2.0.11. Ensuring the application is patched is essential to protecting sensitive server-side data from unauthorized access.