CVE-2026-75830 grav-plugin-api before 1.0.15 Path Traversal via batchCopy
An authenticated editor can exploit path traversal in the Grav API plugin to write arbitrary files to the server filesystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75830?
CVE-2026-75830 is a high-severity path traversal vulnerability in getgrav grav, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.
Weakness: CWE-73
Which versions are affected by CVE-2026-75830?
How do I fix CVE-2026-75830?
No fix has been published for CVE-2026-75830 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-75830 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75830 exists.
Sources
Also known as GHSA-r93f-38mc-xpvv.