CVE-2026-42845: Grav Unvalidated Stream File Readcve-2026-42845-grav-unvalidated-stream-file-read
An arbitrary file read and path traversal vulnerability was found. The code resolves a user-supplied path using a stream locator but fails to validate that the resulting path is within the expected root directory using `realpath()`. An attacker can pass directory traversal sequences or absolute paths to read sensitive files.
