CVE-2026-72697 Grav CMS before 2.0.16 Path Traversal via media_directory
Authenticated attackers with page authoring privileges can exploit a path traversal flaw in Grav CMS to read arbitrary files accessible to the web server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72697?
CVE-2026-72697 is a high-severity path traversal vulnerability in getgrav grav, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.
Weakness: CWE-22
Which versions are affected by CVE-2026-72697?
2 open source packages ship an affected version, including getgrav/grav.
| Package | Affected | Fixed in |
|---|---|---|
getgrav/grav Packagist | All versions | 2.0.16 |
getgrav/grav Packagist | All versions | 2.0.16 |
How do I fix CVE-2026-72697?
Upgrade getgrav/grav to 2.0.16 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72697 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72697 exists.
Sources
Also known as GHSA-47ch-6w46-6xm7.