Listen to this Post
The vulnerability operates within Grav CMS’s Admin UI when a user with account creation privileges attempts to create a new user. The system accepts a username input that is directly used to construct the file path for storing the user’s YAML configuration file. Normally, this file is saved in the `user/accounts/` directory. However, if the username contains path traversal sequences such as `../` or ..\, the input is not properly sanitized or validated. This allows the attacker to break out of the intended directory. During the file write operation, the system concatenates the username with the base directory path without preventing directory traversal. Consequently, the YAML file, which contains sensitive account details like email, hashed password, two-factor authentication secret, and access permissions, is written to an arbitrary location specified by the attacker. For example, a username like `..\Nijat` results in the YAML file being saved in the parent directory of user/accounts/. By carefully crafting the username, an attacker can target critical YAML files such as system.yaml, email.yaml, or existing user account files. Specifically, using a username like `..\accounts\victim_user` overwrites the YAML file of that victim, enabling the attacker to modify the victim’s email and password hash. This leads to full account compromise. The flaw stems from inadequate input validation and insecure path handling in the user creation logic, allowing arbitrary YAML file write or overwrite with controlled content.
Platform: Grav CMS
Version: Admin UI versions
Vulnerability: Path traversal YAML write
Severity: Critical
date: 2025-09-29
Prediction: Patch date unknown
What Undercode Say:
find /path/to/grav -name ".yaml" -exec grep -l "../" {} \;
curl -X POST -d "username=../malicious" http://target/admin
// Example vulnerable path construction $file = "user/accounts/" . $_POST['username'] . ".yaml";
how Exploit:
1. Log in as administrator.
2. Create user with malicious username.
3. Overwrite system or user YAML files.
4. Modify credentials or disrupt services.
Protection from this CVE
- Sanitize username inputs.
- Validate file paths.
- Apply least privilege.
- Update Grav CMS.
Impact:
- Account takeover possible.
- Configuration corruption.
- Service disruption.
- Requires backup restoration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
