The Grav API Plugin (getgrav/grav-plugin-api) before version 1.0.10 improperly sanitizes the slug parameter in the POST /pages/{route}/move endpoint by only removing leading periods but failing to neutralize path traversal sequences such as '/' or '..'. This allows an authenticated API user with the api.pages.write permission to move entire page directories, including content and media, to arbitrary writable locations outside the user/pages/ directory and potentially outside the Grav installation root. This vulnerability is tracked as CVE-2026-65896 and has a CVSS 4.0 base score of 7.1, indicating high severity.

An attacker with authenticated API access and the api.pages.write permission can perform directory traversal via crafted slug values, enabling them to move page directories to arbitrary writable locations outside the designated content directory. This could result in unauthorized file system modifications, potentially affecting the integrity and availability of the Grav installation's content and media files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict api.pages.write permissions to trusted users only and monitor for suspicious API activity involving the move endpoint. Avoid exposing the API to untrusted networks.