CVE-2026-78851
Deferred Deferred - Pending Action

Directory Traversal in Grav CMS via GravExtension.php

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-78851
EUVD
EUVD-2026-102184

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78851 is an authenticated information disclosure vulnerability in Grav CMS versions 2.0.3 through 2.0.6. It allows users with page-editing privileges to perform path traversal attacks via the media_directory() function in Twig-enabled content. Attackers can use absolute or relative paths to access files outside intended directories, exposing sensitive information like filesystem paths and filenames.

Detection Guidance

To detect CVE-2026-78851, check Grav CMS versions 2.0.3 through 2.0.6 for the vulnerable media_directory() function in GravExtension.php. Inspect Twig-enabled page content for absolute paths or traversal sequences like ../../../../. Review web server logs for unauthorized file access attempts or unusual path patterns in requests.

Impact Analysis

This vulnerability allows attackers to enumerate files on the server readable by the web user, map the filesystem, and identify sensitive files. They may access image/SVG files outside the webroot through public cache or URL generation. However, exploitation requires authentication and page-editing privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing confidential files. Compliance may be impacted if attackers access protected user data or system files.

Mitigation Strategies

Immediately upgrade Grav CMS to a patched version. Remove media_directory from the Twig sandbox allowlist. Implement strict path containment by resolving paths with realpath() and rejecting traversal sequences. Ensure paths remain within approved Grav-controlled directories. Restrict page-editing privileges to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart