Grav before version 2.0.16 contains a path traversal flaw in the MediaUploadTrait::deleteFile() method that lets authenticated users who have media‑management rights delete any file on the server. The code checks only the basename of the supplied filename, ignoring embedded "../" sequences; when passed to unlink() these sequences enable removal of files outside the designated media directory. The impact is the loss of confidentiality or integrity of arbitrary files, which could undermine site stability or allow an attacker to delete logs or configuration files.

The affected vendor is getgrav and the product is Grav CMS. All installations of Grav running a version earlier than 2.0.16 are vulnerable, regardless of operating system or deployment environment.

The CVSS score of 7.1 indicates a high severity risk. EPSS is not available, so the current probability of exploitation is unknown, but the vulnerability is not yet listed in CISA KEV. The attack requires web authentication with media‑management permissions; therefore the attacker must first access the CMS and then provide a crafted filename containing directory traversal characters to trigger the delete.