The Grav API Plugin, before version 1.0.10, does not properly validate the slug parameter used in the POST /pages/{route}/move endpoint. The plugin only removes leading periods, leaving directory separators and parent‑directory references untouched. An authenticated API caller with the api.pages.write permission can therefore supply a slug containing path traversal sequences, such as 01.home/../../../pwned, that cause the server to move an entire page directory—including its content and media files—to an arbitrary writable location outside the standard user/pages directory. This allows an attacker to relocate files to unexpected places, potentially leading to unauthorized file modification, content loss, or placement of files in directories that may be served by the web server, thereby compromising site integrity.

The vulnerability affects any deployment of the Grav CMS that includes the Grav API Plugin (Composer package getgrav/grav-plugin-api) prior to version 1.0.10. The vendor is getgrav, and the product name is Grav, with the relevant component being the API plugin that exposes the move operation.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated caller who has the api.pages.write permission and who sends a POST request to /pages/{route}/move. The likely attack vector is the exposed API endpoint; the attack therefore is limited to users who can authenticate to the Grav API and who have write permissions. The impact is primarily unauthorized file manipulation and potential data loss, rather than direct code execution, as the description does not indicate execution of arbitrary code.