Executive Summary

This vulnerability is a path traversal issue in Grav CMS prior to version 1.8.0-beta.27. It allows authenticated users with administrative privileges to read arbitrary files on the server by exploiting insufficient input sanitization in the backup tool. Specifically, user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker with administrative access to read sensitive files on the server that should not be accessible, potentially exposing confidential information. The impact depends on the privileges of the user account running the application, but it can lead to significant data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Update Grav CMS to version 1.8.0-beta.27 or later, as this version contains the fix for the path traversal vulnerability. Additionally, restrict administrative access to trusted users only and monitor for any unusual file access patterns.

Useful 0 Not Useful 0