CVE-2026-72697

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16

Description An issue exists in the media directory() Twig function that fails to validate filesystem paths. Authenticated users with page authoring privileges can provide arbitrary filesystem paths to this function and use the allow-listed filepath accessor on Medium objects to enumerate and read the contents of files outside the intended scope, provided the files match configured media extensions and are accessible by the web server process.

Recommendations Update Grav CMS to version 2.0.16 or later.