---
id: GHSA-mmwh-j75q-gxp8
title: >-
  Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() —
  arbitrary file disclosure via publicly-cached images
summary: >-
  Duplicate Advisory: Grav: Path Traversal in ImageMedium::watermark() —
  arbitrary file disclosure via publicly-cached images
severity: high
cvss: 7.5
cwe:
  - CWE-22
vendor: getgrav
product: getgrav/grav
ecosystem: composer
affected:
  - getgrav/grav = 2.0.10
published: '2026-08-03'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:44Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-mmwh-j75q-gxp8'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69089'
  - url: >-
      https://github.com/getgrav/grav/commit/b282200a65ce979377963180629babd2335212ba
  - url: >-
      https://github.com/getgrav/grav/commit/c569a53304cd7d95ff21bffa6fc590adcf0be83d
  - url: >-
      https://github.com/getgrav/grav/commit/db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f
  - url: >-
      https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-watermark
  - url: 'https://github.com/advisories/GHSA-mmwh-j75q-gxp8'
tags:
  - ghsa
  - composer
ingestedAt: '2026-09-17T17:23:30.684Z'
---

## Overview

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-w3f4-8pj2-599w. This link is maintained to preserve external references.

### Original Description
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.

## Affected packages

- `getgrav/grav = 2.0.10`

## Remediation

Refer to the advisory for the patched release.