H3-2026-1038¶

Grav CMS Watermark Path Traversal File Disclosure Vulnerability

Description¶

Getgrav Grav CMS accepts an unsanitized file path in the watermark parameter of its ImageMedium image processing pipeline. The path is passed to the UniformResourceLocator resolver, which only lexically collapses dot dot segments without a containment or realpath check, allowing a relative traversal string to resolve to an arbitrary file outside the media sandbox. If the resolved path is a valid image, its pixel content is composited into a carrier image and the derivative is cached and served from a public, unauthenticated URL. Remote attackers can trigger this by requesting a page containing an image and supplying a crafted watermark query parameter. The flaw requires a Grav site with at least one rendered homepage image using the watermark feature.

Impact¶

Remote attackers read arbitrary server side files such as configuration, private keys, and credentials through publicly cached images. The exposure persists for any cached derivative until manually purged. Organizations running public Grav CMS sites face reconnaissance and credential theft risk from anonymous visitors.

References¶

• Grav Security Advisory GHSA-w3f4-8pj2-599w
• Grav Watermark Path Traversal Fix Commit