A path traversal flaw in Grav’s admin plugin allows an authenticated administrator who holds the admin.pages.create permission to supply directory traversal characters in the language code field of the Save As action. This omission in input validation lets the attacker create or overwrite arbitrary Markdown (.md) files outside the intended pages directory, potentially placing malicious content or code on the server. Because the created files are written directly to the filesystem, an attacker can overwrite sensitive files or deliver payloads that may be executed by the web application or interpreted by other components, leading to possible remote code execution or other privilege‑escalation scenarios.

Grav (GetGrav) installations that are older than version 1.10.55 are affected. Any deployment using the default admin plugin configuration before the 1.10.55 release is vulnerable unless a later patch has been applied.

The vulnerability carries a CVSS score of 7.1, indicating a high impact, and the EPSS score is not available, so the exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog, but because it requires authentication as an admin with page‑creation rights, the attack surface is limited to users with those privileges. An attacker who is already logged in as such an administrator can directly exploit the flaw to write arbitrary files, which can lead to further compromise if the uploaded content is later processed or executed by the system.