{"id":"CVE-2026-78851","title":"Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.","summary":"Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22","CWE-200"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:43.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78851","references":[{"url":"https://github.com/SLO-CYBER-SEC/CVE-2026-78851","label":"cve@mitre.org"},{"url":"https://github.com/getgrav/grav","label":"cve@mitre.org"},{"url":"https://github.com/getgrav/grav/blob/2.0.6/system/config/security.yaml#L325","label":"cve@mitre.org"},{"url":"https://github.com/getgrav/grav/blob/2.0.6/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1629","label":"cve@mitre.org"},{"url":"https://github.com/SLO-CYBER-SEC/CVE-2026-78851","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T18:46:12.816122Z"},"exploits":{"github":1,"githubRepos":["https://github.com/SLO-CYBER-SEC/CVE-2026-78851"],"checkedAt":"2026-10-15T19:26:21.076Z"},"ingestedAt":"2026-10-15T17:18:20.102Z","slug":"CVE-2026-78851","body":"## Overview\n\nDirectory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":222683,"id":"CVE-2026-78851","ts":1792092520167,"field":"cvss","old":null,"new":"6.5"},{"seq":222682,"id":"CVE-2026-78851","ts":1792092520167,"field":"severity","old":"none","new":"medium"}]}