The grav-plugin-api provides an API endpoint at /api/v1/pages/batch that allows authenticated editors to duplicate pages. A bug in versions 1.0.0‑beta.10 through 1.0.14 left the "suffix" parameter unvalidated, allowing path‑traversal sequences. An authenticated user with api.pages.write permission can craft a request containing sequences such as /../../../ and write arbitrary page content and media files to any directory writable by the web‑server process. This means the attacker could overwrite critical files or deploy web shells, affecting confidentiality, integrity, or availability of the site.

The vulnerability affects installations of the Grav CMS framework that include the grav-plugin-api plugin, specifically versions 1.0.0‑beta.10 up to and including 1.0.14. All users of getgrav:grav who have that plugin version are potentially impacted.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known exploited vulnerability yet. However, the attack requires only authenticated editors with api.pages.write permission, which are relatively common roles on a site. The path traversal flaw allows writing to arbitrary locations, meaning an attacker could replace files, inject malicious code, or disrupt site functionality. The lack of a public exploit does not reduce the potential risk; administrators should treat it as a high‑impact vulnerability until mitigated.