What is CVE-2026-75830?
CVE-2026-75830 is a path traversal vulnerability in the grav-plugin-api plugin for Grav CMS, affecting versions >= 1.0.0-beta.10 and <= 1.0.14. An authenticated attacker can exploit the unvalidated 'suffix' parameter in the batchCopy method via a POST request to /api/v1/pages/batch to perform unauthorized file operations. Updating to the latest plugin version is strongly advised.
Azərbaycanca: CVE-2026-75830, Grav CMS-in grav-plugin-api plaginində path traversal zəifliyidir. 1.0.0-beta.10 ilə 1.0.14 arası versiyalar təsirlənir, burada autentifikasiya olunmuş istifadəçi batchCopy funksiyasındakı 'suffix' parametri vasitəsilə serverdə fayl əməliyyatlarını manipulyasiya edə bilər. Plaginin ən son versiyaya yenilənməsi tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which plugin in Grav CMS is affected by CVE-2026-75830?
This path traversal vulnerability affects the grav-plugin-api plugin for Grav CMS.
Does exploiting CVE-2026-75830 require authentication?
Yes, an attacker must be an authenticated user to exploit the vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.