---
id: CVE-2026-72697
title: >-
  Grav CMS before 2.0.16 contains a path traversal vulnerability in the
  media_directory() Twig function that fails to validate filesystem paths,
  allowing authenticated users to enumerate and access files outside intended
  scope
summary: >-
  Grav CMS before 2.0.16 contains a path traversal vulnerability in the
  media_directory() Twig function that fails to validate filesystem paths,
  allowing authenticated users to enumerate and access files outside intended
  scope. Attackers w…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: getgrav
product: grav
affected:
  - grav < 2.0.16
patched:
  - getgrav/grav 2.0.16
published: '2026-08-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72697'
references:
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/grav-cms-before-path-traversal-via-media-directory
    label: disclosure@vulncheck.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-47ch-6w46-6xm7'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72697'
  - url: 'https://github.com/advisories/GHSA-47ch-6w46-6xm7'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - composer
epss: 0.00376
epssPercentile: 0.31434
aliases:
  - GHSA-47ch-6w46-6xm7
ecosystem: composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-25T18:01:04.836593Z'
ingestedAt: '2026-09-17T21:29:16.998Z'
---

## Overview

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-72697)

Affected packages:

- `getgrav/grav <= 2.0.15`

Patched in:

- `getgrav/grav 2.0.16`

Source: https://github.com/advisories/GHSA-47ch-6w46-6xm7