Grav API Path Traversal in Batch Page Copy

CVE-2026-75830 is a path traversal vulnerability affecting Grav's plugin API versions 1.0.0-beta.10 through 1.0.14. The vulnerability exists in the PagesController::batchCopy() method where the 'suffix' parameter accepts user input via POST requests to /api/v1/pages/batch without proper validation. An authenticated user with editor-level permissions (api.pages.write) can inject path traversal sequences like /../../../ to escape the intended user/pages/ directory and potentially read, write, or manipulate files outside the intended scope. This is particularly concerning because it requires only mid-level API permissions rather than super-admin access, significantly expanding the attack surface for compromised editor accounts or malicious insiders.

While MITRE ATT&CK techniques aren't formally mapped to this CVE, Casky.ai's Claude-powered analysis would identify this as a file system access vulnerability related to Defense Evasion (T1548) and lateral movement techniques. Practitioners using Casky would see findings highlighting the unvalidated user input in API parameters, the insufficient path normalization that allows directory traversal, and the permission model weakness that grants dangerous file operations to non-administrative accounts. The platform's extended reasoning would flag this as a regression—an incomplete fix to a previous vulnerability (GHSA-qjq4-jp55-4mx2)—helping security teams recognize patterns of remediation failures that often indicate areas requiring deeper code review and validation testing.