A high-severity vulnerability in Grav CMS allows local attackers to perform unauthorized file operations, potentially leading to full system compromise.

This vulnerability is caused by improper link resolution (CWE-59), which enables an attacker to manipulate file access by following symbolic links. The vulnerability is exploitable by an unauthenticated local user.

Successful exploitation allows an attacker to access, modify, or delete sensitive files on the host system, which could lead to unauthorized data disclosure or service disruption. With a CVSS score of 8.4, this flaw represents a significant risk to the integrity and availability of the server environment.

Immediate Action: Upgrade to Grav CMS version 2.0.16 or later to incorporate the security fix.

Proactive Monitoring: Monitor filesystem access logs for suspicious activity, particularly involving unexpected file creation or access patterns near the application root.

Compensating Controls: Ensure the application is running with the principle of least privilege, specifically restricting the web server user's ability to follow symbolic links or access files outside the designated web directory.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention to prevent unauthorized local system access. Administrators must prioritize updating to version 2.0.16 to ensure the underlying file handling mechanism is secured against symlink exploitation.