Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75830grav-plugin-api before 1.0.15 Path Traversal via batchCopy

High 7.1

In plain English

A high-severity security flaw in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 1.0.15

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

GitHub Security Advisory (GHSA-g6j3-8jv9-ch5f) vendor-advisory
VulnCheck Advisory: grav-plugin-api before 1.0.15 Path Traversal via batchCopy third-party-advisory