CVE-2026-65896 Details
Description
Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.
A path traversal vulnerability has been identified in the Grav API Plugin (Composer package getgrav/grav-plugin-api) versions prior to 1.0.10. The issue arises in the POST /pages/{route}/move endpoint, where the PagesController::move() method fails to properly validate the slug field. The current sanitization only removes leading periods, leaving the possibility to exploit the slug with path traversal sequences. An authenticated API caller with the api.pages.write permission can manipulate the slug to move an entire page directory, including content and media, to an arbitrary writable location outside the user/pages/ directory and potentially outside the Grav installation.
Users are advised to update to Grav API Plugin version 1.0.10 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/getgrav/grav-plugin-api/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd | [email protected] | |
| https://github.com/getgrav/grav/security/advisories/GHSA-qjq4-jp55-4mx2 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/grav-api-plugin-before-path-traversal-via-move | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav API Plugin | <= 1.0.9 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 28, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |