CVE-2026-69089 Grav CMS before 2.0.11 Path Traversal via watermark
An attacker can exploit a path traversal flaw in Grav CMS to read arbitrary files outside the media sandbox and serve them publicly.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69089?
CVE-2026-69089 is a high-severity path traversal vulnerability in getgrav grav, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.
Weakness: CWE-22
Which versions are affected by CVE-2026-69089?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | From 2.0.10 | 2.0.11 |
getgrav/grav Packagist | From 2.0.10 | 2.0.11 |
How do I fix CVE-2026-69089?
Upgrade getgrav/grav to 2.0.11 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-69089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69089 exists.
Sources
Also known as GHSA-w3f4-8pj2-599w.