CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.16 are vulnerable to a path traversal flaw in the MediaUploadTrait::deleteFile() method, allowing authenticated users with media management permissions to delete arbitrary files by exploiting directory traversal sequences. This vulnerability can lead to unauthorized file deletion outside the designated media storage area, posing a significant risk to system integrity. Organizations using Grav for media management should prioritize patching to mitigate potential data loss and security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.