CVE-2026-75830 getgrav CVE debrief

Who should care

Defenders and administrators using the grav-plugin-api, especially those with editor-level access, should assess exposure and prioritize remediation. This includes reviewing user permissions, monitoring for suspicious activity, and applying the fix in version 1.0.15. Additionally, defenders should verify the grav-plugin-api version, restrict access to the api.pages.write permission, and implement compensating controls for exposed systems.

Why it matters

CVE-2026-75830 is a path traversal vulnerability in the grav-plugin-api that allows authenticated users to write to arbitrary filesystem locations. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where the grav-plugin-api is used with editor-level access.

• Potential for writing attacker-controlled content to arbitrary filesystem locations
• Possible elevation of privileges through path traversal
• Risk of data tampering and unauthorized content modification
• Need for verification of affected versions and remediation

Technical summary

The grav-plugin-api contains a path traversal vulnerability in the PagesController::batchCopy() method. An authenticated user with the api.pages.write permission can supply path traversal sequences in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. This vulnerability is a result of an incomplete fix for a previous vulnerability, which left the 'suffix' parameter unvalidated. The vulnerability is confirmed in grav-plugin-api versions >= 1.0.0-beta.10 and <= 1.0.14. Defenders should prioritize verifying and remediating this vulnerability, especially in environments with

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where the grav-plugin-api is used with editor-level access.

Recommended defensive actions

• Verify the grav-plugin-api version and check for exposure
• Restrict access to the api.pages.write permission
• Monitor for suspicious page content and media uploads
• Apply the fix in version 1.0.15
• Perform a thorough review of the system for potential backdoors
• Implement additional logging and monitoring for page content and media uploads
• Review user permissions and access controls for the grav-plugin-api

Evidence notes

The vulnerability is confirmed in grav-plugin-api versions >= 1.0.0-beta.10 and <= 1.0.14. An incomplete fix for a previous vulnerability left the 'suffix' parameter unvalidated, allowing for path traversal attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.