[HIGH] Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

PKSA-9871-4yy4-mgt8 CVE-2026-72697 GHSA-47ch-6w46-6xm7

Affected package: getgrav/grav

Affected version: <=2.0.15

Reported by:
GitHub