CVE-2026-69089 Details
Description
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.
A path traversal vulnerability has been identified in Grav CMS version 2.0.10. The issue arises in the ImageMedium::watermark() function, which passes an unsanitized image argument to the resource locator. This vulnerability allows an editor to manipulate Markdown image syntax to include traversal sequences, potentially accessing arbitrary image files outside of Grav's media sandbox. These files are then composited into a carrier image, cached, and served from a public URL, exposing them to anonymous visitors.
Users can upgrade to Grav CMS version 2.0.11, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/getgrav/grav/commit/b282200a65ce979377963180629babd2335212ba | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/getgrav/grav/commit/c569a53304cd7d95ff21bffa6fc590adcf0be83d | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/getgrav/grav/commit/db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f | [email protected] | Source CodeVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-watermark | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav CMS | 2.0.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |