Nihaddhuseynli

**Name of the Vulnerable Software and Affected Versions** Grav CMS version 2.0.10 **Description** A path traversal issue exists in the `ImageMedium::watermark()` function, which passes an unsanitized `$image` argument to `RocketThemeToolboxResourceLocatorUniformResourceLocator::findResource()`. The `file://` scheme branch only performs lexical collapse of `..` segments without verifying the real path or containment. This allows an editor using Markdown image syntax with traversal sequences to include arbitrary image files from outside the media sandbox into a carrier image. The resulting image is cached and served via a public, unauthenticated URL, leading to the disclosure of files to anonymous visitors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.