CVE-2026-75830

Name of the Vulnerable Software and Affected Versions grav-plugin-api versions 1.0.0-beta.10 through 1.0.14

Description A path traversal issue exists in the PagesController::batchCopy() method. An authenticated user with api.pages.write permissions can provide path traversal sequences in the suffix parameter via the 'POST /api/v1/pages/batch' endpoint. This allows the user to bypass the intended user/pages/ directory and write arbitrary page content and media to any filesystem location accessible by the web server process.

Recommendations Update to version 1.0.15. As a temporary workaround, restrict access to the 'POST /api/v1/pages/batch' endpoint or avoid using the suffix parameter until the update is applied.