The Grav API Plugin before 1.0.10 fails to properly validate the slug parameter in the POST /pages/{route}/move endpoint. The PagesController::move() method sanitizes the slug only by stripping leading periods using ltrim, but does not prevent path traversal sequences such as '/' or '..'. An authenticated API caller with the api.pages.write permission can exploit this to move entire page directories to arbitrary writable locations outside the designated user/pages/ directory, including locations outside the Grav installation. This represents an external control of file name or path vulnerability.

An attacker with authenticated API access and the api.pages.write permission can move page directories and their contents to arbitrary writable locations outside the intended directory structure. This could lead to unauthorized file system modifications outside the Grav installation, potentially impacting system integrity and security. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users only and monitor for suspicious use of the move endpoint. Avoid granting api.pages.write permission broadly. Review and harden file system permissions to limit writable locations accessible by the Grav process.