CVE-2026-65896Patch

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

DFIR Lab@DFIR_Lab91d
Patch
🚨 HIGH severity CVE-2026-65896 (CVSS 7.1) in Grav API Plugin <1.0.10. Path traversal flaw allows authenticated attackers to move page directories outside installation root. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/8GEjvy5tTB
Post summary
The tweet announces a high‑severity path traversal vulnerability (CVE‑2026‑65896) in Grav API Plugin versions below 1.0.10 and urges users to update immediately.
0000049
99 followersView on X

Explore more

Back to dashboard