CVE-2026-72695: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in getgrav grav

The vulnerability exists in Grav CMS versions prior to 2.0.16 in the MediaUploadTrait::deleteFile() method. The method validates only the basename of the filename using Utils::checkFilename(), which disallows traversal sequences, but does not validate the directory path portion. As a result, an attacker can supply a filename with '../' sequences in the directory path, which is concatenated and passed to unlink() without proper sanitization. This allows deletion of arbitrary files outside the intended media storage directory. The flaw is reachable by authenticated users with media management permissions via the Flex media handling pipeline. The sibling method renameFile() also lacks proper validation but is currently unused in core.

An authenticated user with media management permissions can delete arbitrary files on the server, including critical configuration files (e.g., user/config/system.yaml), other users' content files, and authentication-related YAML files. This can cause denial of service by removing essential application files and may enable privilege escalation by deleting security configurations. The vulnerability has a high severity rating (CVSS 7.1 to 8.1 depending on source) due to the potential for integrity and availability impact without requiring UI interaction.

No official patch link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix is to apply Utils::checkFilename() to the full filename parameter, including directory path, or reject any filename containing directory separators or '..' sequences before deletion. Until a patch is available, restrict media management permissions to trusted users only to mitigate risk.