{"apiVersion":"1.0","identifier":"CVE-2026-75830","description":"grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled -suffix- parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.","publishedAt":"2026-08-18T12:19:32","lastModifiedAt":"2026-08-18T15:17:14","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75830","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","epssProbability":0.00279,"riskScore":0.73,"affectedProduct":"grav-plugin-api","affectedVersions":">=1.0.0-beta.10,<=1.0.14","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-75830","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-75830","en":"https://www.redsauce.net/en/cves/CVE-2026-75830","fr":"https://www.redsauce.net/fr/cves/CVE-2026-75830","pt":"https://www.redsauce.net/pt/cves/CVE-2026-75830","de":"https://www.redsauce.net/de/cves/CVE-2026-75830","sk":"https://www.redsauce.net/sk/cves/CVE-2026-75830","el":"https://www.redsauce.net/el/cves/CVE-2026-75830"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-75830"}}