CVE-2026-72696

Name of the Vulnerable Software and Affected Versions Grav CMS versions prior to 2.0.16

Description A symlink following issue exists in the createLockFile() function of the Scheduler Job. Local attackers can overwrite arbitrary files by pre-creating symbolic links (symlinks) at predictable lock file paths within the world-writable temporary directory. By pointing a symlink to a file that the web server process has permission to write to, the next scheduled job execution will follow the link and overwrite the target file's content with the job ID string.

Recommendations Update Grav CMS to version 2.0.16 or later.