CVE-2026-65896

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.10

Description An issue exists where the software fails to properly validate the slug field in the 'POST /pages/{route}/move' endpoint. The PagesController::move() function only strips leading periods, failing to neutralize '/' or '..' segments. This allows an authenticated API caller with the api.pages.write permission to use path traversal sequences to move an entire page directory, including content and media, to an arbitrary writable location outside the user/pages/ directory, potentially extending beyond the Grav installation.

Recommendations Update Grav API Plugin to version 1.0.10 or later. Avoid using the slug parameter in the 'POST /pages/{route}/move' endpoint until the update is applied.