Grav CMS before version 2.0.16 contains a path traversal flaw in the media_directory Twig function. The function fails to validate file system paths, enabling authenticated users with page‑authoring rights to supply arbitrary paths and have the system read any file whose extension matches the configured media types that the web‑server process can access. This permits exploitation to expose sensitive system files, configuration files, or other data stored outside the intended media directory. The weakness is a classic path traversal (CWE‑22).

All installations of Grav CMS with a version earlier than 2.0.16 are vulnerable. The affected product is Grav CMS (getgrav:grav). The flaw stems from the media_directory Twig function used in page rendering. The vulnerability is present in all versions prior to 2.0.16; users running 2.0.16 or newer are not affected.

The CVSS score of 7.1 indicates a medium to high risk. The EPSS score is not available, so the likelihood of present exploitation cannot be quantified. The flaw requires the attacker to have authenticated access with page‑authoring privileges, which are typically granted to content editors. Once those privileges are obtained, the attacker can enumerate and read any media‑type files accessible by the web server. The vulnerability is listed as not in the CISA KEV catalog, but the impact on confidentiality can be significant. Inferences about the attack vector note that the code path is triggered by an authenticated request containing a custom path, suggesting that an attacker would likely use the Grav admin interface or craft a request to the Twig media_directory function to reference arbitrary files.