Path Traversal in Grav CMS Media Management

Executive Summary

This is a path traversal vulnerability in Grav CMS versions before 2.0.16. It allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences like ../. The MediaUploadTrait::deleteFile() method only validates the basename of the filename while passing unvalidated directory paths to the unlink() function, enabling deletion of files outside the intended media storage directory.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS version with: grep -r "version" /path/to/grav/vendor/composer/installed.json. If version is below 2.0.16, the system is vulnerable. Review media upload logs for suspicious filenames containing ../ sequences.

Useful 0 Not Useful 0

Impact Analysis

An attacker with media management permissions could delete critical files such as configuration files, content files, or authentication-related files. This could lead to system compromise, data loss, or denial of service by disrupting Grav CMS functionality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially violating data integrity requirements under GDPR and HIPAA. Loss of configuration or content files may result in non-compliance with record-keeping and security controls mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.16 or later immediately. Temporarily restrict media management permissions to trusted users until patched. Monitor file deletion logs for unauthorized activity.

Useful 0 Not Useful 0