Ka3N1X

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.16 **Description** An issue exists where authenticated users with media management permissions can delete arbitrary files. This occurs because the `deleteFile()` function in `MediaUploadTrait` only validates the basename of the filename, failing to sanitize directory traversal sequences such as `../`. Consequently, these unvalidated paths are passed to the `unlink()` function, allowing the deletion of files located outside the designated media storage directory. **Recommendations** Update Grav to version 2.0.16 or later. As a temporary mitigation, restrict media management permissions to only highly trusted users.