Listen to this Post
The CVE-2025-66302 vulnerability is a path traversal flaw in Grav CMS version 1.7.49.5, affecting the backup functionality within the admin panel. Authenticated attackers with administrative privileges can exploit this by manipulating the “Root Folder” parameter during backup creation. Due to insufficient input sanitization, user-supplied paths are not restricted to the webroot directory. Attackers can inject directory traversal sequences like “/../../../../” to escape the intended directory. This allows access to arbitrary files on the server filesystem, such as system files, configuration files, or SSH keys. The backup process follows the manipulated path and includes files from outside the webroot in the backup archive. The attacker can then download this archive and extract sensitive data. The vulnerability arises from the lack of path canonicalization and validation before file operations. It is exploitable via the web interface, requiring admin credentials. When the application runs with high privileges, such as root, the impact escalates to complete server compromise. The flaw highlights critical issues in input handling and privilege separation in web applications.
Platform: Grav CMS
Version: 1.7.49.5
Vulnerability: Path Traversal
Severity: Critical
date: 2025-06-19
Prediction: Patched June 2025
What Undercode Say:
Analytics:
Bash command to test vulnerability:
curl -k -L -b “grav-admin-session=valid” -X POST -d “root_folder=/../../../../etc/passwd” https://target.com/admin/tools/backups/create
Vulnerable code snippet:
$rootFolder = $this->getParam(‘root_folder’);
$backupPath = BASE_DIR . $rootFolder;
Fix code snippet:
$rootFolder = realpath($this->getParam(‘root_folder’));
if (strpos($rootFolder, BASE_DIR) !== 0) {
throw new Exception(‘Invalid path’);
}
How Exploit:
1. Login as admin.
2. Go to /admin/tools/backups.
3. Set Root Folder to /../../../../root/.ssh/.
4. Save and backup.
5. Download archive.
Protection from this CVE
- Update Grav CMS.
- Apply security patch.
- Validate input paths.
Impact:
- Arbitrary file read.
- Server compromise.
- Data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
