Technical impact
Grav CMS 2.0.10 contains a path traversal vulnerability in the ImageMedium::watermark() function, which forwards its unsanitized image argument to the UniformResourceLocator::findResource() method. The file:// scheme branch of the locator collapses '..' sequences without a containment check, allowing an editor who can add or edit Markdown to include a traversal sequence in an image URL. The result is that arbitrary files outside the media sandbox can be composited into a carrier image, cached, and then served from a public, unauthenticated URL, disclosing those files to anonymous visitors.
Affected Systems
Identified by the Common Platform Enumeration string cpe:2.3:a:getgrav:grav, this flaw affects the Grav CMS product from getgrav, specifically versions prior to 2.0.11. The vendor’s advisories and source‑code commits confirm that versions 2.0.10 and earlier are vulnerable.
Risk and Exploitability
With a CVSS score of 8.7, this vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that it is not currently confirmed exploited in the wild. Nevertheless, the attack vector is straightforward: an unauthenticated user who can edit markdown content can craft a malicious image tag, triggering the path traversal. Successful exploitation results in unauthorized disclosure of arbitrary local files to all visitors, compromising confidentiality and potentially enabling further attacks.
Github GHSA