---
id: CVE-2026-85603
title: >-
  Grav versions before 1.10.55 contain a path traversal vulnerability in the
  admin plugin's Save As action that fails to validate the language code
  parameter
summary: >-
  Grav versions before 1.10.55 contain a path traversal vulnerability in the
  admin plugin's Save As action that fails to validate the language code
  parameter. An authenticated admin user with admin.pages.create permission can
  supply direct…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-73
vendor: getgrav
product: grav
affected:
  - grav < 1.10.55
published: '2026-09-04'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:16:58.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85603'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-h9g9-73c3-23c9'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-admin-plugin-path-traversal-via-save-as-language-code
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00625
epssPercentile: 0.47757
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:19:29.057775Z'
ingestedAt: '2026-09-08T20:10:03.165Z'
---

## Overview

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write arbitrary .md files outside the pages directory with attacker-controlled content.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.