Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\Resourc…

Grav CMS version 2.0.10 contains a path traversal vulnerability in the ImageMedium::watermark() method. The vulnerability arises because the unsanitized $image argument is passed to UniformResourceLocator::findResource() without proper containment checks. The file:// scheme branch only lexically collapses '..' segments, lacking a realpath or sandbox containment check. An authenticated editor can craft Markdown image syntax with traversal sequences to access arbitrary image files outside the media sandbox. These files are then composited into a carrier image, cached, and served from a public unauthenticated URL, leading to information disclosure. Multiple GitHub commits have been issued as fixes, along with a security advisory on GitHub and coverage from VulnCheck. The vulnerability represents a significant risk due to unauthenticated access to disclosed files.