EUVD-2026-309959

fkie_cve-2026-42608

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as __form-flash-id in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an index.yaml file containing attacker-controlled data. This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments. This vulnerability is fixed in 2.0.0-beta.2.

GHSA-hmcx-ch82-3fv2 — Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

Affected: Packagist: getgrav/grav

# Vulnerability Report: Grav CMS Unauthenticated Path Traversal & Arbitrary File Write

**[ZERO-DAY] Unauthenticated Path Traversal leading to Arbitrary Directory Creation and Configuration Injection**

## Summary

Grav CMS (v1.7.49.5 and latest development source) is vulnerable to a Zero-Day Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as `__form-flash-id` in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an `index.yaml` file containing attacker-controlled data.

This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments.

## Affected Component

- Versions: Confirmed in Grav v1.7.49.5 (latest stable) and the latest development source (March 2026). - Class: `Grav\Framework\Form\FormFlash` - Method: `__construct()` / `getTmpDir()` - Parameter: `session_id` (Mapped to `__form-flash-id` in POST requests)

## Vulnerability Details

The FormFlash class is used to persist form data across redirects. It constructs a temporary storage path using the provided session_id. The path construction logic in the latest source:

```php $folder = $config['folder'] ?? ($this->sessionId ? 'tmp://forms/' . $this->sessionId : ''); $this->folder = $folder && $locator->isStream($folder) ? $locator->findResource($folder, true, true) : $folder; ```

Lack of sanitization o…

Most recent entries from all

EUVD-2026-309959

fkie_cve-2026-42608

GHSA-hmcx-ch82-3fv2 — Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component