CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.13 are vulnerable due to inadequate validation of backup profile root paths, enabling attackers with profile editor access to exploit directory traversal vulnerabilities. This flaw allows unauthorized access to sensitive files outside the designated GRAV_ROOT, potentially exposing critical data from system directories such as /opt, /mnt, or /srv. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.