CVE-2026-72696: Grav CMS Path Traversal Vulnerability

CVE-2026-72696 Overview

CVE-2026-72696 is a symlink following vulnerability in Grav CMS versions before 2.0.16. The flaw resides in the Scheduler Job::createLockFile() function, which creates lock files at predictable paths within a world-writable temporary directory. Local attackers can pre-create symbolic links at these predictable lock file paths, pointing to any file the web server process has permission to write. When the next scheduled job runs, the Scheduler follows the symlink and overwrites the target file's contents with the job ID string. This vulnerability is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Local attackers can overwrite arbitrary files writable by the web server user, corrupting configuration, application code, or logs.

Affected Products

Grav CMS versions prior to 2.0.16
Installations using the Grav Scheduler feature
Systems with world-writable temp directories accessible to local users

Discovery Timeline

2026-08-25 - CVE-2026-72696 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-72696

Vulnerability Analysis

The vulnerability originates in the Job::createLockFile() method of the Grav Scheduler component. This function generates lock files at deterministic paths inside the system temporary directory, which is typically world-writable on Unix-like systems. Because the paths are predictable and the directory is shared, any local user can anticipate where a lock file will be created before the scheduled job runs.

Grav does not verify whether the target lock path is already a symbolic link before writing. When the Scheduler executes and calls the write operation, PHP follows the attacker-controlled symlink and writes the job ID string to whatever file the symlink references. The write occurs with the privileges of the web server process, expanding the attacker's effective write capabilities beyond their own user context.

Exploitation requires local access to the host but no authentication to Grav itself. The write payload is limited to the job ID string, so attackers cannot inject arbitrary content, but they can still corrupt sensitive files, truncate logs, or damage configuration files to enable follow-on attacks.

Root Cause

The root cause is missing symlink validation before file creation, combined with predictable file paths in a world-writable directory. The Scheduler assumes exclusive ownership of the lock path without checking file type, ownership, or whether the path already exists as a link.

Attack Vector

A local attacker predicts the lock file path used by an upcoming scheduled job. The attacker creates a symlink at that path pointing to a target file writable by the web server, such as a PHP configuration file, .htaccess, or a plugin script. When cron triggers the scheduled job, Grav writes the job ID string through the symlink, overwriting the target file. See the GitHub Security Advisory and the VulnCheck Advisory on Grav CMS for technical details.

Detection Methods for CVE-2026-72696

Indicators of Compromise

Symbolic links present in the system temp directory pointing to files owned by the web server user
Unexpected file modifications to Grav configuration files, plugin scripts, or .htaccess files containing only a job ID string
Files under the web root truncated or overwritten with short numeric or hash-like content
Scheduler log entries showing successful lock file creation at unexpected inode targets

Detection Strategies

Audit temp directory contents for symlinks referencing paths outside the temp directory, particularly targets in the Grav installation directory
File integrity monitoring on Grav core files, user/config/, and plugin directories to detect unauthorized overwrites
Correlate Scheduler execution timestamps with file modification events on non-temp paths

Monitoring Recommendations

Enable auditd or equivalent syscall monitoring for symlink(), symlinkat(), and open() calls targeting Grav lock file paths
Monitor process activity from the web server user for file writes outside expected directories
Alert on any local user account creating files in the same temp directory paths used by Grav Scheduler

How to Mitigate CVE-2026-72696

Immediate Actions Required

Upgrade Grav CMS to version 2.0.16 or later
Audit the temp directory for pre-planted symlinks before restarting the Scheduler
Restrict local shell access to the Grav host to trusted administrators only
Verify integrity of Grav configuration, plugin files, and web root content against known-good baselines

Patch Information

The vulnerability is fixed in Grav CMS 2.0.16. Refer to the GitHub Security Advisory GHSA-q8w8-6cq5-j4h2 for patch details and commit references.

Workarounds

Disable the Grav Scheduler feature until the patch can be applied
Configure PHP to use a dedicated, non-world-writable temp directory via sys_temp_dir in php.ini
Set the sticky bit and restrictive permissions on the temp directory to prevent cross-user symlink attacks
Run the web server process under a dedicated user with minimal write permissions to Grav application directories

bash

# Configuration example
# Set a private temp directory for the web server user
mkdir -p /var/www/grav-tmp
chown www-data:www-data /var/www/grav-tmp
chmod 700 /var/www/grav-tmp

# Point PHP to the private temp directory
# Add to php.ini:
# sys_temp_dir = /var/www/grav-tmp

# Verify Grav version after upgrade
cd /var/www/grav && bin/grav -v