The vulnerability lies in the FormFlash component of the Grav web platform. By manipulating the session_id value, passed as __form-flash-id in POST requests, an attacker can traverse the filesystem and create arbitrary directories, writing a crafted index.yaml file. This file write capability permits modification of application configuration or injection of malicious data, potentially compromising data integrity, altering application behavior, and causing service disruption in production environments.

Any Grav installation running a version prior to 2.0.0-beta.2 is affected. The vulnerability is present in the getgrav:grav product. Versions 2.0.0-beta.2 and later contain a fix.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw can be exploited by an unauthenticated attacker through normal web interactions, specifically by sending crafted POST requests to the FormFlash endpoint. Because the attacker does not require authentication, the attack surface is high, and any exposed Grav instance could be immediately compromised.