CVE-2026-78851
Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.
n/a n/a
CVSS
6.5MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.12%Chance of exploitation activity in the next 30 days, higher than 65% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Affected versions 1
- n/aaffected: n/aCVE List
References 4
- github.com/getgrav/grav/blob/2.0.6/system/config/security.yaml#L325Advisoryvia CVE List
- github.com/SLO-CYBER-SEC/CVE-2026-78851Exploitvia CVE List
- github.com/getgrav/gravReferencevia CVE List
- github.com/getgrav/grav/blob/2.0.6/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1629Referencevia CVE List