Grav CMS versions prior to 2.0.16 have a path traversal vulnerability in the media_directory() Twig function. This flaw allows authenticated users with page authoring privileges to supply arbitrary filesystem paths, enabling them to enumerate and read files outside the intended directory scope. The vulnerability arises because the function does not properly validate filesystem paths, permitting access to any file matching configured media extensions accessible by the web server process.