---
id: CVE-2026-72695
title: >-
  Grav before 2.0.16 contains a path traversal vulnerability in
  MediaUploadTrait::deleteFile() that allows authenticated users with media
  management permissions to delete arbitrary files by supplying filenames with
  directory traversal sequ…
summary: >-
  Grav before 2.0.16 contains a path traversal vulnerability in
  MediaUploadTrait::deleteFile() that allows authenticated users with media
  management permissions to delete arbitrary files by supplying filenames with
  directory traversal sequ…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
vendor: getgrav
product: grav
affected:
  - grav < 2.0.16
patched:
  - getgrav/grav 2.0.16
published: '2026-08-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72695'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-before-path-traversal-via-mediauploadtrait-deletefile
    label: disclosure@vulncheck.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-jq29-c7v8-rg55'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72695'
  - url: 'https://github.com/advisories/GHSA-jq29-c7v8-rg55'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - composer
epss: 0.00631
epssPercentile: 0.5002
aliases:
  - GHSA-jq29-c7v8-rg55
ecosystem: composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-25T17:38:00.813215Z'
ingestedAt: '2026-09-17T21:29:16.995Z'
---

## Overview

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-72695)

Affected packages:

- `getgrav/grav <= 2.0.15`

Patched in:

- `getgrav/grav 2.0.16`

Source: https://github.com/advisories/GHSA-jq29-c7v8-rg55