Symlink Following Vulnerability in Grav CMS by GetGrav

CVE-2026-72696

What is CVE-2026-72696?

Grav CMS versions prior to 2.0.16 are vulnerable to a symlink following flaw in the Scheduler Job::createLockFile() method. This vulnerability enables local attackers to exploit the world-writable temp directory by pre-creating symbolic links at predictable lock file paths. When a scheduled job is executed, it follows the symlink, resulting in the overwriting of arbitrary files accessible by the web server process, effectively replacing the target's content with the job ID string. To mitigate this risk, it is essential for users to upgrade to version 2.0.16 or later.

References