Listen to this Post
How the CVE works:
Grav, a file-based CMS, stores user account data as YAML files in the user/accounts/ directory. When an admin user creates a new account via the Admin UI, the submitted username is used to generate the YAML filename. The application fails to sanitize the username input, allowing path traversal sequences like “../” or “..\”. An attacker can supply a username such as “../../../tmp/evil” which is appended to the base path without validation. This causes the system to write the account YAML file outside the intended directory. The YAML file contains sensitive fields: email, fullname, twofa_secret, and hashed_password. By controlling the username, an attacker can dictate where this file is written, potentially to web-accessible locations or critical system paths. The vulnerability stems from trusting user input for filesystem operations without canonicalization or traversal checks. This arbitrary file write can lead to account takeover, privilege escalation, or remote code execution if the written file is processed or served. The flaw is fixed in version 1.8.0-beta.27 by implementing proper input sanitization to strip path traversal sequences from usernames before file creation.
Platform: Grav
Version: Pre 1.8.0-beta.27
Vulnerability: Path Traversal
Severity: Critical
Date: 12/01/2025
Prediction: Fixed 1.8.0-beta.27
What Undercode Say:
Analytics:
Craft username with path traversal
username="../../../../tmp/exploit"
Simulate admin request to create user
curl -X POST -H "Authorization: Bearer <token>" -d "username=${username}&[email protected]" http://localhost/admin/users
// Example vulnerable code snippet $userFile = "user/accounts/" . $_POST['username'] . ".yaml"; file_put_contents($userFile, $yamlData);
How Exploit:
Admin logs in, creates user with malicious username containing path traversal sequences. System writes YAML file to unintended location, potentially overwriting system files or placing data in web root. Attacker accesses sensitive info or executes code via written file.
Protection from this CVE:
Update to Grav 1.8.0-beta.27. Sanitize username input, reject path traversal sequences. Use realpath() for file operations. Restrict server write permissions.
Impact:
Arbitrary file write, account compromise, privilege escalation, possible RCE, data disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
