https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:12:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-72697 <p>Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.</p> <p>Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-72697 https://vulnerability.circl.lu/vuln/ghsa-47ch-6w46-6xm7 <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>The `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`system/config/security.yaml`). Its implementation, `GravExtension::mediaDirFunc()`, only treats the input as unsafe when it looks like a Grav stream (`user://`, `theme://`, etc). If the input is instead a plain filesystem path, absolute or relative, the stream check is skipped entirely and the raw string is handed straight to `new Media($media_dir)`, which lists every file in that directory whose extension matches a configured media type (which by default includes `txt`, `json`, `xml`, `pdf`, `doc`, `docx`, and more, not just images) and builds `Medium` objects for them.</p> <p>Separately, the sandbox&#39;s own allow-list for the `Medium` class includes the `filepath` accessor. A code comment directly above that allow-list entry states the developers&#39; intent was for `filepath` to be part of the &#34;dangerous surface&#34; that &#34;stays blocked&#34;, but it is listed as an allowed method on the very same line, contradicting that stated intent.</p> <p>Combined, a user who can enter page content that gets processed as Twig (`process.twig: true` in frontmatter, or any modular page, which is unsandboxed and unconditional per the code comment in `processPage()`) can point `media_directory()` at any directory the web server process can read, anywhere on the filesystem, and both enumerate and read the content of any file in it whose extension is a recognized media type.</p> <p>## Affected product and…</p> <p><strong>Affected:</strong> Packagist: getgrav/grav</p> <p>## Summary</p> <p>The `media_directory()` Twig function is allow-listed for use in sandboxed, editor-authored page content (`system/config/security.yaml`). Its implementation, `GravExtension::mediaDirFunc()`, only treats the input as unsafe when it looks like a Grav stream (`user://`, `theme://`, etc). If the input is instead a plain filesystem path, absolute or relative, the stream check is skipped entirely and the raw string is handed straight to `new Media($media_dir)`, which lists every file in that directory whose extension matches a configured media type (which by default includes `txt`, `json`, `xml`, `pdf`, `doc`, `docx`, and more, not just images) and builds `Medium` objects for them.</p> <p>Separately, the sandbox&#39;s own allow-list for the `Medium` class includes the `filepath` accessor. A code comment directly above that allow-list entry states the developers&#39; intent was for `filepath` to be part of the &#34;dangerous surface&#34; that &#34;stays blocked&#34;, but it is listed as an allowed method on the very same line, contradicting that stated intent.</p> <p>Combined, a user who can enter page content that gets processed as Twig (`process.twig: true` in frontmatter, or any modular page, which is unsandboxed and unconditional per the code comment in `processPage()`) can point `media_directory()` at any directory the web server process can read, anywhere on the filesystem, and both enumerate and read the content of any file in it whose extension is a recognized media type.</p> <p>## Affected product and…</p> https://vulnerability.circl.lu/vuln/ghsa-47ch-6w46-6xm7