Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/getgrav/grav/commit/b282200a65ce979377963180629babd2335212ba
disclosure@vulncheck.com
https://github.com/getgrav/grav/commit/c569a53304cd7d95ff21bffa6fc590adcf0be83d
disclosure@vulncheck.com
https://github.com/getgrav/grav/commit/db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f
disclosure@vulncheck.com
https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-waterma…
disclosure@vulncheck.com