CVE-2026-72695

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16

Description An issue exists where authenticated users with media management permissions can delete arbitrary files. This occurs because the deleteFile() function in MediaUploadTrait only validates the basename of the filename, failing to sanitize directory traversal sequences such as ../. Consequently, these unvalidated paths are passed to the unlink() function, allowing the deletion of files located outside the designated media storage directory.

Recommendations Update Grav to version 2.0.16 or later. As a temporary mitigation, restrict media management permissions to only highly trusted users.