---
id: CVE-2026-69089
title: >-
  Grav CMS 2.0.10 contains a path traversal vulnerability in
  ImageMedium::watermark(), which passes its unsanitized $image argument to
  RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource()
summary: >-
  Grav CMS 2.0.10 contains a path traversal vulnerability in
  ImageMedium::watermark(), which passes its unsanitized $image argument to
  RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource().
  Because the file:// scheme b…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: getgrav
product: grav
affected:
  - grav < 2.0.11
patched:
  - getgrav/grav 2.0.11
published: '2026-08-03'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:33.413'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69089'
references:
  - url: >-
      https://github.com/getgrav/grav/commit/b282200a65ce979377963180629babd2335212ba
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/getgrav/grav/commit/c569a53304cd7d95ff21bffa6fc590adcf0be83d
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/getgrav/grav/commit/db8c1fcd63aaaf6d6b244bc6b4cfa5f7b96bbc7f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-watermark
    label: disclosure@vulncheck.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69089'
  - url: 'https://github.com/advisories/GHSA-w3f4-8pj2-599w'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-03T20:04:13.400180Z'
epss: 0.00459
epssPercentile: 0.39605
aliases:
  - GHSA-w3f4-8pj2-599w
ecosystem: composer
ingestedAt: '2026-09-17T17:23:30.684Z'
---

## Overview

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69089)

Affected packages:

- `getgrav/grav = 2.0.10`

Patched in:

- `getgrav/grav 2.0.11`

Source: https://github.com/advisories/GHSA-w3f4-8pj2-599w