Path Traversal in grav-plugin-api PagesController::batchCopy() allowing Arbitrary File Write

Vulnerability Overview Vulnerability Name: Path Traversal in Description: A path traversal vulnerability exists in the method of the . An attacker can bypass existing validation logic by constructing a malicious parameter, enabling arbitrary file writes. Affected Scope Affected Versions: 1.0.0-beta.10 to 1.0.14 Fixed Version: 1.0.15 Privilege Requirements: Requires permission (Editor level, not Super Administrator) CVSS Score: 7.1 (High) Remediation Fix Code: Add strict validation for the parameter in the method to ensure it does not contain illegal characters or path traversal sequences. Specific Fix: Use the method to validate , ensuring it consists of only a single path segment. POC Code Exploitation Steps 1. Authentication: Authenticate using a user with privileges. 2. Create Source Page: Create a page containing malicious content. 3. Trigger Batch Copy: Call the endpoint with a path traversal-based parameter. 4. Verify File Write: Check the target directory to confirm that files were written outside the expected location. Impact Integrity (High): Attackers can create arbitrary directories and write files, compromising content integrity. Availability (Low): May lead to disk space exhaustion or service interruption. Confidentiality (None): No sensitive data is leaked. Affected Users Grav CMS deployments using the plugin, particularly those granting permissions to non-super administrator users. Notes Potential RCE Risk: If executable files exist on the server, attackers may achieve Remote Code Execution (RCE) by writing malicious files.

Goal Reached Thanks to every supporter — we hit 100%!

Path Traversal in grav-plugin-api PagesController::batchCopy() allowing Arbitrary File Write

More from this source