GitHub Security Advisory: GHSA-hmcx-ch82-3fv2
Package: getgrav/grav (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.0.0-beta.2
Patched in: 2.0.0-beta.2

Summary: Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

Details:
# Vulnerability Report: Grav CMS Unauthenticated Path Traversal & Arbitrary File Write

**[ZERO-DAY] Unauthenticated Path Traversal leading to Arbitrary Directory Creation and Configuration Injection**

## Summary

Grav CMS (v1.7.49.5 and latest development source) is vulnerable to a Zero-Day Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as `__form-flash-id` in POST requests), an unauthenticated attacker can traverse the filesystem to create arbitrary directories and write an `index.yaml` file containing attacker-controlled data.

This vulnerability can lead to unauthorized modification of application behavior, potential data integrity issues, and service disruption in production environments.

## Affected Component

- Versions: Confirmed in Grav v1.7.49.5 (latest stable) and the latest development source (March 2026).
- Class: `Grav\Framework\Form\FormFlash`
- Method: `__construct()` / `getTmpDir()`
- Parameter: `session_id` (Mapped to `__form-flash-id` in POST requests)

## Vulnerability Details

The FormFlash class is used to persist form data across redirects. It constructs a temporary storage path using the provided session_id. The path construction logic in the latest source:

```php
$folder = $config['folder'] ?? ($this->sessionId ? 'tmp://forms/' . $this->sessionId : '');
$this->folder = $folder && $locator->isStream($folder) ? $locator->findResource($folder, true, true) : $folder;
```

Lack of sanitization on the sessionId (the raw session identifier) allows the use of `../` sequences. When `findResource` resolves the stream, it allows escape into any writable directory within the webserver's scope (typically `user/config/`, `cache/`, `logs/`, and `tmp/`).

## Affected Versions & Zero-Day Status

- Tested Version: v1.7.49.5 (Latest Stable Release as of Nov 2025).
- Development Branch Status: Vulnerable. The latest source code in the GitHub develop branch (March 2026) remains unpatched.
- Affected Range: All Grav CMS versions utilizing the FormFlash component (v1.7.x and potentially older v1.6.x versions).
- CVE Status: Zero-Day (Non-Registered). Extensive research confirmed no existing CVE addresses this specific core FormFlash session-based traversal.

## Steps to Reproduce

1. Identify any page containing a Grav Form (e.g., `/contact`).
2. Intercept the POST request during form submission.
3. Modify the `__form-flash-id` parameter to include a traversal sequence targeting a writable directory (e.g., `../../user/config/proof_dir`).
4. Submit the request.
5. Observe that a new directory (`poc/`) and file (`index.yaml`) have been created at the traversed path.

## Request Example

```http
POST /contact HTTP/1.1
Host: target.grav.cms
Content-Type: application/x-www-form-urlencoded

__form-name-=contact&__form-flash-id=../../user/config/proof_dir&form-data[name]=Attack&form-data[message]=Payload
```

## Response / Result

- HTTP/1.1 302 Found (Standard redirect)
- Filesystem Modific