Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-72695Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

High 8.1

In plain English

A high-severity path traversal in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 49.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.16	GHSA-jq29-c7v8-rg55

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.16

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-jq29-c7v8-rg55) vendor-advisory
VulnCheck Advisory: Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile third-party-advisory