CyberRota Analysis
AI-GeneratedThe Grav API Plugin prior to version 1.0.10 is vulnerable due to insufficient validation of the slug field in the POST /pages/{route}/move endpoint, allowing authenticated users with api.pages.write permissions to exploit path traversal sequences. This flaw enables attackers to move entire page directories to arbitrary writable locations, potentially compromising the integrity of the Grav installation. Organizations using this plugin should prioritize patching to mitigate the risk of unauthorized access and data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.