Description
Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | 2.0.11 – < 2.0.13 | 2.0.13 |
References
- GitHub Security Advisory (GHSA-fch7-cpv4-w7hg) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Grav 2.0.11 Path Traversal via Backup Profile Configuration third-party-advisory