EUVD-2026-358873

fkie_cve-2026-72695

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

GHSA-jq29-c7v8-rg55 — Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Affected: Packagist: getgrav/grav

# Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

## Summary

A path traversal vulnerability in `MediaUploadTrait::deleteFile()` allows an authenticated user with media management permissions to delete arbitrary files on the server. The method validates only the basename portion of the filename using `Utils::checkFilename()`, while the directory path (which may contain `../` sequences) is preserved and passed unvalidated to `unlink()`. This enables directory escape from the intended media storage path.

## Severity

**High (8.1)** - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

## CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

## Details

In `system/src/Grav/Common/Media/Traits/MediaUploadTrait.php`, the `deleteFile()` method (lines 332-365) performs filename validation only on the basename, not the full path:

```php public function deleteFile(string $filename, ?array $settings = null): void { $settings = $this->getUploadSettings($settings); $filesystem = Filesystem::getInstance(false);

// Line 339-340: Only the BASENAME is validated $basename = $filesystem->basename($filename); // e.g. "evil.jpg" from "../../evil.jpg" if (!Utils::checkFilename($basename)) { // passes - no traversal in basename throw new RuntimeException(/* ... */); }

$path = $settings['destination'] ?? $this->getPath(); // ...

// Line 353: Full pathname (with traversal) is…

Most recent entries from all

EUVD-2026-358873

fkie_cve-2026-72695

GHSA-jq29-c7v8-rg55 — Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion