Loading story…
A high-severity path traversal flaw tracked as CVE-2026-69089 affects Grav CMS before version 2.0.11, with exploitation confirmed in 2.0.10. The bug resides in ImageMedium::watermark(), where an unsanitized $image argument is passed to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because file:// path handling only collapses .. segments lexically and does not enforce a realpath or containment check, attackers can traverse outside Grav's intended media sandbox.
An editor able to author Markdown image syntax can abuse the watermark feature to reference arbitrary image files on the server, causing those files to be composited into another image. Grav then caches and serves the resulting image from a public unauthenticated URL, enabling anonymous information disclosure. The issue is classified as CWE-22 with a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and Grav CMS 2.0.11 is reported as unaffected.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE record for CVE-2026-69089 was received by disclosure@vulncheck.com. The record describes the Grav CMS path traversal issue and references related GitHub advisories and commits.
A path traversal vulnerability was identified in Grav CMS, confirmed in version 2.0.10 and affecting versions earlier than 2.0.11. The flaw is in ImageMedium::watermark(), where an unsanitized image argument can traverse outside the media sandbox and expose arbitrary image files via a cached public URL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A mass disclosure detailed **11 vulnerabilities** in **Grav CMS** and the **`getgrav/grav-plugin-api`** package, with the most severe issues affecting the API plugin before **`1.0.13`** and Grav CMS before **`2.0.13`**. Multiple API endpoints failed to enforce API key scope caps or relied on bare `isSuperAdmin()` checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (`CVE-2026-72826`), promoting users or invited accounts to super-admin (`CVE-2026-72828`, `CVE-2026-72829`, `CVE-2026-72833`), and disabling 2FA for non-super accounts without a TOTP code via `POST /api/v1/users/{user}/2fa/disable` (`CVE-2026-72822`). The disclosure also included several paths to **remote code execution**. In the API plugin, `CVE-2026-72830` allows attackers with `api.config.write` access to alter scheduler settings and inject commands through `scheduler.custom_jobs`, while `CVE-2026-72824` can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, `CVE-2026-72819` allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and `CVE-2026-72827` enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to **Grav `2.0.13`** and **API plugin `1.0.13`**, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Aug 19, 2026
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026