CVE-2026-75830High· 7.1▾ Twilight

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 39.1 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 18, 2026

Updated

Sep 8, 2026

CVSS

7.1

Vendor

—

Product

—

CWE

CWE-73

Depth score

39 · Low

EPSS

0.34% · p27

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.3% → 0.3%▲ 0.06%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 27 days

Aug 18, 2026Published
Disclosed via NVD
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026EPSS first tracked
0.3%
Sep 14, 2026EPSS peak
0.3% → 0.3%

CWE-73 #nvd

Full technical detail▾

Overview

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed