CVE-2026-69089

Name of the Vulnerable Software and Affected Versions Grav CMS version 2.0.10

Description A path traversal issue exists in the ImageMedium::watermark() function, which passes an unsanitized $image argument to RocketThemeToolboxResourceLocatorUniformResourceLocator::findResource(). The file:// scheme branch only performs lexical collapse of .. segments without verifying the real path or containment. This allows an editor using Markdown image syntax with traversal sequences to include arbitrary image files from outside the media sandbox into a carrier image. The resulting image is cached and served via a public, unauthenticated URL, leading to the disclosure of files to anonymous visitors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.