CyberRota Analysis
AI-GeneratedGrav versions prior to 1.10.55 are vulnerable to a path traversal flaw in the admin plugin's Save As action, allowing authenticated admin users with the appropriate permissions to exploit the unvalidated language code parameter. This vulnerability enables the creation of arbitrary .md files outside the designated pages directory, potentially leading to unauthorized content manipulation. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation by malicious insiders or compromised admin accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content.