CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile
Authenticated users with media permissions can delete arbitrary files outside the media directory via path traversal in Grav CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72695?
CVE-2026-72695 is a high-severity path traversal vulnerability in getgrav grav, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-72695?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 2.0.16 |
getgrav/grav Packagist | All versions | 2.0.16 |
How do I fix CVE-2026-72695?
Upgrade getgrav/grav to 2.0.16 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72695 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72695 exists.
Sources
Also known as GHSA-jq29-c7v8-rg55.