CyberRota Analysis
AI-GeneratedVersions 1.0.0-beta.10 to 1.0.14 of the grav-plugin-api are vulnerable to a path traversal issue in the PagesController::batchCopy() method, allowing authenticated users with editor-level permissions to exploit the unvalidated 'suffix' parameter. This vulnerability enables attackers to write malicious content to arbitrary filesystem locations accessible by the web server, potentially compromising the integrity of the application. Organizations using affected versions should prioritize upgrading to version 1.0.15 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15.