CVE-2026-65896 getgrav CVE debrief

Who should care

Users of Grav API Plugin, administrators of Grav installations, and security teams monitoring API vulnerabilities should be aware of this vulnerability. They should verify if their installations are affected and take necessary actions to mitigate the risk. Security teams should also monitor API logs for suspicious activity and implement compensating controls such as WAF rules to detect and prevent exploitation attempts.

Technical summary

The Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 is vulnerable to path traversal attacks. An authenticated API caller with the api.pages.write permission can supply path traversal sequences to move an entire page directory to an arbitrary writable location outside user/pages/, including outside the Grav installation. This can lead to unauthorized data access and modification.

Defensive priority

Authenticated API callers with the api.pages.write permission can exploit this vulnerability to move page directories to arbitrary writable locations.

Recommended defensive actions

• Inventory and verify installed version of Grav API Plugin
• Restrict api.pages.write permission to necessary users
• Monitor API logs for suspicious move requests
• Apply vendor remediation when available
• Implement compensating controls such as WAF rules

Evidence notes

The Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. To verify, defenders should review API call logs for suspicious move requests and check for unexpected page directory movements.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.