GHSA-jq29-c7v8-rg55: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

A path traversal vulnerability (a flaw where an attacker can use sequences like '../' to escape intended directory boundaries) in Grav CMS's MediaUploadTrait::deleteFile() method allows authenticated users with media management permissions to delete arbitrary files on the server. The vulnerability exists because the code only validates the filename itself, not the directory path, allowing an attacker to craft a filename like '../../data/target.txt' that passes validation but then escapes the media folder when the file is deleted.