HIGH

CVE-2026-65896

CVSS v3

7.1

HIGH

EPSS Score

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to a

Technical details

CVSS v3 Vector
3.1
Published
7/23/2026
Last Modified
7/23/2026

Frequently asked questions

What is CVE-2026-65896?

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to a

Is CVE-2026-65896 actively exploited?

Active exploitation of CVE-2026-65896 has not been confirmed. The EPSS score is N/A%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-65896?

CVE-2026-65896 has a CVSS v3 base score of 7.1 (HIGH severity), with vector string 3.1.

Is CVE-2026-65896 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.