CVE-2026-85603 Details

A path traversal vulnerability has been identified in the Grav admin plugin, affecting versions prior to 1.10.55. The issue arises in the 'Save As' action, where the language code parameter is not properly validated. This vulnerability allows authenticated admin users with the 'admin.pages.create' permission to inject directory traversal sequences into the 'lang' POST field. As a result, they can write arbitrary Markdown files outside the designated pages directory, containing content controlled by the attacker.

Users are advised to update Grav to version 1.10.55 or later, where this vulnerability has been patched.