Ivanesk315

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions 1.0.0-beta.10 through 1.0.14 **Description** A path traversal issue exists in the `PagesController::batchCopy()` method. An authenticated user with `api.pages.write` permissions can provide path traversal sequences in the `suffix` parameter via the 'POST /api/v1/pages/batch' endpoint. This allows the user to bypass the intended `user/pages/` directory and write arbitrary page content and media to any filesystem location accessible by the web server process. **Recommendations** Update to version 1.0.15. As a temporary workaround, restrict access to the 'POST /api/v1/pages/batch' endpoint or avoid using the `suffix` parameter until the update is applied.