{"id":"GHSA-mmwh-j75q-gxp8","title":"Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images","summary":"Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images","severity":"high","cvss":7.5,"cwe":["CWE-22"],"vendor":"getgrav","product":"getgrav/grav","ecosystem":"composer","affected":["getgrav/grav = 2.0.10"],"published":"2026-08-03","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:16:44Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mmwh-j75q-gxp8","references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69089"},{"url":"https://github.com/getgrav/grav/commit/b282200a65ce979377963180629babd2335212ba"},{"url":"https://github.com/getgrav/grav/commit/c569a53304cd7d95ff21bffa6fc590adcf0be83d"},{"url":"https://github.com/getgrav/grav/commit/db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f"},{"url":"https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-watermark"},{"url":"https://github.com/advisories/GHSA-mmwh-j75q-gxp8"}],"tags":["ghsa","composer"],"ingestedAt":"2026-09-17T17:23:30.684Z","slug":"GHSA-mmwh-j75q-gxp8","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-w3f4-8pj2-599w. This link is maintained to preserve external references.\n\n### Original Description\nGrav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\\Toolbox\\ResourceLocator\\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.\n\n## Affected packages\n\n- `getgrav/grav = 2.0.10`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}