Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-72696Grav CMS before 2.0.16 Symlink Following via createLockFile

High 8.4

In plain English

A high-severity security flaw in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.16

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-q8w8-6cq5-j4h2) vendor-advisory
VulnCheck Advisory: Grav CMS before 2.0.16 Symlink Following via createLockFile third-party-advisory