CVE-2026-69089 is a path traversal vulnerability in Grav CMS 2.0.10 affecting the ImageMedium::watermark() method. The vulnerability arises because the $image argument is passed unsanitized to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). The file:// scheme handling only lexically collapses '..' segments without performing a realpath or containment check, enabling crafted Markdown image syntax with directory traversal sequences to access files outside Grav's media sandbox. These files are composited into a carrier image, cached, and then served from a public, unauthenticated URL, resulting in disclosure of arbitrary files to anonymous users.

An attacker can cause Grav CMS to disclose arbitrary image files outside the intended media directory by exploiting the path traversal flaw. This leads to unauthorized information disclosure through publicly accessible URLs without authentication. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted Markdown content that includes image syntax or apply manual input validation to sanitize image paths to prevent directory traversal sequences. Monitor official Grav CMS channels for updates and patches addressing this vulnerability.