CVE-2026-65896
Received Received - Intake

Path Traversal in Grav API Plugin

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65896
EUVD
EUVD-2026-48246

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav grav-plugin-api to 1.0.10 (exc)
getgrav grav_plugin_api to 1.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65896 is a path traversal vulnerability in Grav CMS's API plugin. It allows authenticated users with the api.pages.write permission to move page directories outside the intended user/pages/ directory to any writable location on the filesystem. The issue occurs because the slug parameter is only stripped of leading periods but not other path traversal sequences like / or .., enabling attackers to escape the pages directory and place files in arbitrary locations.

For example, an attacker could provide a crafted slug like 01.home/../../../pwned to move files to /tmp or other unintended locations.

Detection Guidance

Check Grav CMS versions for the getgrav/grav-plugin-api package. Use commands like 'composer show getgrav/grav-plugin-api' or inspect Grav's admin panel for version details. Monitor API logs for suspicious POST requests to /pages/{route}/move with crafted slug parameters containing path traversal sequences like '../' or '/'.

Inspect filesystem for unauthorized file movements outside user/pages/. Look for directories with unusual names or files in locations like /tmp or system directories. Enable verbose logging in Grav to track API endpoint activity.

Impact Analysis

This vulnerability allows unauthorized file relocation, potential overwriting of critical files, or denial-of-service by removing source pages. Attackers could move entire page directories including content and media to arbitrary writable locations outside the Grav installation.

The impact includes data integrity risks, unauthorized access to sensitive files, and disruption of Grav CMS functionality. The vulnerability requires authentication but not elevated privileges.

Mitigation Strategies

Upgrade the getgrav/grav-plugin-api package to version 1.0.10 or later immediately. This patched version includes proper validation of the slug parameter to prevent path traversal.

Temporarily revoke the api.pages.write permission from non-admin users until the upgrade is complete. Review filesystem permissions to restrict write access to sensitive directories.

Monitor for any signs of exploitation, such as files moved outside user/pages/. Check logs for POST requests to /pages/{route}/move with suspicious slug values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart