The vulnerability is a missing authorization check in the API plugin's BlueprintPathResolver. An API key granted only the media write scope but issued from a super‑admin account can bypass the intended access controls. The attacker can then POST files or GET file listings inside another user's scoped directory, writing arbitrary image files and reading the enumeration of that directory. This allows unauthorized read/write access to user data and could be leveraged for further compromise.

Grav 2.0 installations that include the getgrav/grav-plugin-api prior to version 1.0.14, which are bundled with the core Grav package. The patch is included in version 1.0.15.

The CVSS score of 9.3 indicates a high severity exploit. No EPSS data is available, but the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an authenticated API user with a key minted on a super‑admin account. The API endpoints POST /blueprint-upload and GET /blueprint-files enable the attack once the missing authorization is exercised.