Grav CMS FormFlash Component Unauthenticated Path Traversal & Arbitrary File Write Zero-Day Analysis

Vulnerability Summary: Grav CMS FormFlash Component Unauthenticated Path Traversal & Arbitrary File Write Vulnerability Overview Title: [ZERO-DAY] Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component Description: A zero-day path traversal vulnerability exists in the FormFlash core component of Grav CMS (v1.7.49.5 and latest development source code). By manipulating the (passed as in a POST request), an attacker can traverse the file system to create arbitrary directories and write files containing attacker-controlled data. Risk: Could lead to unauthorized modification of application behavior, data integrity compromise, and service disruption. Impact Scope Affected Component: class within the Grav Framework. Affected Versions: Grav CMS v1.7.49.5 (latest stable release) Latest development source code (March 2026) All Grav CMS versions using the FormFlash component (v1.7.x and older) Trigger Condition: Requires a page containing a Grav form (e.g., Contact, Login, Registration) and the attacker's ability to intercept and modify the parameter in the POST request. Remediation Fixed Version: 2.0.0-beta.2 Fix Measures: 1. Sanitize Session ID: Apply strict regex or strict alphanumeric checks to , , and in . 2. Filesystem Hardening: Ensure and other sensitive directories have restrictive permissions to prevent writing. 3. Update Grav: Monitor and apply patches related to FormFlash sanitization. Proof of Concept (POC) 1. Exploit Code (Request Example) 2. Exploit Result (Response / Result) Filesystem Changes: Directory Created: File Created: 3. Verification Commands & Output (Proof of Concept Evidence) Before Exploitation: After Exploitation: 4. Fix Code Snippet (Maintainer note - fix applied)

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS FormFlash Component Unauthenticated Path Traversal & Arbitrary File Write Zero-Day Analysis

More from this source