Overview
CVE-2025-66302 describes a medium severity path traversal vulnerability affecting Grav CMS, a file-based Web platform. This flaw allows authenticated attackers with administrative privileges to read arbitrary files on the server’s file system. The vulnerability resides within the backup tool due to insufficient input sanitization of user-supplied paths.
Technical Details
The vulnerability occurs because the backup tool in Grav CMS prior to version 1.8.0-beta.27 fails to properly sanitize user-provided paths. Specifically, the application does not adequately restrict access to files outside of the intended webroot directory. An attacker with administrative access can manipulate the path provided to the backup functionality to read sensitive files such as configuration files, application code, or even system files, depending on the privileges of the user account running the application.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) assigns this vulnerability a score of 6.8 (MEDIUM).
- CVSS Score: 6.8
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
This score reflects the relatively straightforward exploitation and the potential for significant information disclosure. While it requires administrative privileges, the ease of exploitation and the potential impact warrant prompt attention.
Possible Impact
Successful exploitation of this vulnerability can lead to:
- Sensitive Information Disclosure: Attackers can read configuration files containing database credentials, API keys, and other sensitive information.
- Source Code Exposure: Access to the application’s source code may reveal further vulnerabilities or business logic.
- Potential for Privilege Escalation: In some scenarios, access to system files could lead to privilege escalation or further compromise of the server.
- Compliance Violations: Exposure of sensitive data could lead to violations of data protection regulations.
Mitigation and Patch Steps
The vulnerability is fixed in Grav CMS version 1.8.0-beta.27. The recommended mitigation is to upgrade to this version or a later release as soon as possible.
- Upgrade Grav CMS: The most effective solution is to upgrade your Grav CMS installation to version 1.8.0-beta.27 or later. This version contains the necessary fix to prevent the path traversal.
- Review Access Controls: Ensure that administrative access is granted only to trusted users.
- Web Application Firewall (WAF): Consider implementing a Web Application Firewall (WAF) with rules that can detect and block path traversal attempts. While not a replacement for patching, a WAF can provide an additional layer of security.
References
GitHub Commit: ed640a13143c4177af013cf001969ed2c5e197ee
GitHub Security Advisory: GHSA-j422-qmxp-hv94
