https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:14:53 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-11003 bdu:2026-11003 https://cve.radiocsirt.org/vuln/bdu:2026-11003 https://cve.radiocsirt.org/vuln/euvd-2026-343957 EUVD-2026-343957 https://cve.radiocsirt.org/vuln/euvd-2026-343957 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69089 <p>Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses &#39;..&#39; segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav&#39;s media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.</p> <p>Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses &#39;..&#39; segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav&#39;s media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69089 https://cve.radiocsirt.org/vuln/ghsa-w3f4-8pj2-599w <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>Reported by: Nihad Huseynli (@nihaddhuseynli (https://github.com/nihaddhuseynli)) — nihadd.huseynli@gmail.com</p> <p>▎ Note: I attempted to report this via security@getgrav.org first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead.</p> <p>Path Traversal in ImageMedium::watermark() leading to arbitrary file disclosure via publicly-served images</p> <p>Summary</p> <p>The watermark media action, documented and allow-listed for use in editor-authored Markdown image syntax, passes its $image argument unsanitized into UniformResourceLocator::findResource(). That resolver only lexically collapses .. segments (no realpath()/containment check) and, for the default file:// scheme, resolves straight to file_exists() with no re-validation against the registered stream root. A relative-path traversal string therefore resolves to an arbitrary absolute path on disk. If that path is a valid image, its pixel content is composited into the carrier image and the result is cached and served from a public, unauthenticated URL — i.e. any file outside Grav&#39;s media sandbox that happens to be a decodable image becomes visible to anonymous visitors, not just to the attacker.</p> <p>Affected version</p> <p>- Grav CMS, develop/2.0 line, commit db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f (tip of 2.0.11 post-release). - Root cause lives in the pinned dependency rockettheme/toolbox v2.x-dev @ c569a53304cd7d95ff21bffa6fc590adcf0be83d (per composer.lock), specifically RocketTheme\Toolbo…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>Reported by: Nihad Huseynli (@nihaddhuseynli (https://github.com/nihaddhuseynli)) — nihadd.huseynli@gmail.com</p> <p>▎ Note: I attempted to report this via security@getgrav.org first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead.</p> <p>Path Traversal in ImageMedium::watermark() leading to arbitrary file disclosure via publicly-served images</p> <p>Summary</p> <p>The watermark media action, documented and allow-listed for use in editor-authored Markdown image syntax, passes its $image argument unsanitized into UniformResourceLocator::findResource(). That resolver only lexically collapses .. segments (no realpath()/containment check) and, for the default file:// scheme, resolves straight to file_exists() with no re-validation against the registered stream root. A relative-path traversal string therefore resolves to an arbitrary absolute path on disk. If that path is a valid image, its pixel content is composited into the carrier image and the result is cached and served from a public, unauthenticated URL — i.e. any file outside Grav&#39;s media sandbox that happens to be a decodable image becomes visible to anonymous visitors, not just to the attacker.</p> <p>Affected version</p> <p>- Grav CMS, develop/2.0 line, commit db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f (tip of 2.0.11 post-release). - Root cause lives in the pinned dependency rockettheme/toolbox v2.x-dev @ c569a53304cd7d95ff21bffa6fc590adcf0be83d (per composer.lock), specifically RocketTheme\Toolbo…</p> https://cve.radiocsirt.org/vuln/ghsa-w3f4-8pj2-599w