CVE-2020-29556

The vulnerability resides in the Backup functionality of Grav CMS versions up to 1.7.0-rc.17. A path-traversal flaw allows an attacker to read arbitrary local files on the server by manipulating backup-related parameters [1].

Exploitation requires authentication to the Grav admin panel. However, due to a lack of CSRF protection on the backup feature, an unauthenticated attacker can trick an authenticated admin into performing the malicious action, effectively bypassing the authentication requirement [1].

Successful exploitation enables an attacker to read sensitive files from the server, such as configuration files containing database credentials or other secrets, leading to further compromise [1].

As of the publication date, users should upgrade to a patched version if available. The Grav project may have addressed this in later releases; consult the official repository for updates [2].