CVE-2026-85603

Grav CMS before 1.10.55 contains a path traversal flaw (CWE-73) in the Admin plugin's 'Save As' action, where the 'lang' POST parameter is accepted without validation of the language code. An authenticated user holding the admin.pages.create permission can send directory traversal sequences in that field to write .md files outside the pages directory with attacker-controlled content. Successful exploitation gives the attacker an arbitrary file-write primitive on the server, which the CVSS 4.0 score (7.1, High) treats as high impact on the vulnerable system given the network attack vector, low required privileges, and no user interaction. Only Grav deployments running the Admin plugin and granting admin.pages.create to an account an attacker can obtain (e.g., a low-trust or compromised admin) are practically exposed. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.4% (33rd percentile), so no exploitation is currently known.

What to do: Upgrade Grav to version 1.10.55 or later and keep the Admin plugin on its latest release; as interim mitigations, restrict admin.pages.create to trusted administrators. Defenders should also audit for unexpected .md files outside the pages directory as a sign of possible exploitation.