An authenticated path traversal vulnerability in Grav versions before 2.0.16 permits attackers to manipulate or delete files on the host system.

This is a path traversal vulnerability (CWE-22) identified within the MediaUploadTrait component. Authenticated attackers can leverage this flaw to escape intended directory boundaries during file handling processes.

The ability to traverse directories and potentially delete files poses a severe risk to the integrity and availability of the Grav CMS instance. Given the CVSS score of 8.1, this vulnerability could be used by a malicious insider or a compromised account to cause significant operational disruption or data loss.

Immediate Action: Update the Grav CMS installation to version 2.0.16 or later to secure the file handling logic.

Proactive Monitoring: Review administrative audit logs for any unusual file management activity or attempts to access files outside of standard media directories.

Compensating Controls: Implement file system permissions that restrict the web server user to only the necessary directories, thereby limiting the scope of any potential traversal.

Public Exploit Available: No

Maintaining the integrity of the Grav environment is critical for operational security. Administrators should prioritize upgrading to version 2.0.16 to mitigate this path traversal risk and protect against unauthorized file system modifications.