Path Traversal in Grav Plugin API

Executive Summary

This is a path traversal vulnerability in the grav-plugin-api for Grav CMS affecting versions 1.0.0-beta.10 through 1.0.14. An authenticated user with editor-level api.pages.write permission can exploit unvalidated user input in the suffix parameter to write files to arbitrary filesystem locations outside the intended user/pages/ directory.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS plugin versions using commands like 'composer show getgrav/grav-plugin-api' or inspect the plugin directory for version files. Look for versions between 1.0.0-beta.10 and 1.0.14. Review web server logs for suspicious POST requests to /api/v1/pages/batch with unusual suffix parameters containing path traversal sequences like ../../../.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite critical files, inject malicious content, or cause disk exhaustion leading to service disruption. While remote code execution is not confirmed, it remains a theoretical risk if PHP handler misconfigurations exist. Integrity loss is high as attacker-controlled content can be written anywhere writable by the web server process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file modifications or data exfiltration, violating integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized file writes may result in non-compliance with data protection and access control provisions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade grav-plugin-api to version 1.0.15 or later immediately. If upgrading is not possible, restrict write permissions for the api.pages.write role to prevent unauthorized file writes. Monitor filesystem changes and web server logs for signs of exploitation.

Useful 0 Not Useful 0