CVE-2026-75830

HIGH 7.1

grav-plugin-api before 1.0.15 Path Traversal via batchCopy

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.

CWE	CWE-73
Vendor	getgrav
Product	grav
Published	Aug 18, 2026
Last Updated	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new high vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

getgrav / grav

0 < 1.0.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-g6j3-8jv9-ch5f vulncheck.com: https://www.vulncheck.com/advisories/grav-plugin-api-before-path-traversal-via-batchcopy

Credits

🔍 ivanesk315