CVE-2026-72696 in Grav
Summary
by MITRE • 08/25/2026
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID string.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Grav CMS prior to version 2.0.16 represents a classic race condition combined with insecure temporary file handling, specifically categorized under CWE-59: Improper Link Resolution Before File Access. This flaw resides within the Scheduler component's Job::createLockFile() method, which is responsible for generating lock files to prevent concurrent execution of scheduled tasks. The core technical deficiency lies in the predictable nature of the file paths used for these locks and the lack of atomic operations or secure temporary directory practices during their creation. In a typical Linux environment, system-wide temporary directories such as /tmp are world-writable, meaning any local user on the same operating system instance can create files within this space without restriction.
An attacker with local access to the server where Grav CMS is hosted can exploit this predictability by pre-creating symbolic links at the exact paths that the Scheduler expects for its lock files. Because the path generation algorithm does not incorporate randomization or unique identifiers, an attacker can anticipate the filename and location of the upcoming lock file. By establishing a symlink from this predictable temporary path to any target file on the system, the attacker sets a trap. When the Grav CMS scheduler executes and attempts to create its lock file using standard write operations that follow symbolic links by default in many configurations or due to specific implementation details, it inadvertently writes data into the location pointed to by the symlink rather than creating a new independent file.
The operational impact of this vulnerability is significant because it allows for arbitrary local file overwrite with low privileges. The content written during this process is not random garbage but contains the job ID string associated with the scheduled task. While overwriting files with specific strings might seem limited, it can be leveraged in conjunction with other vulnerabilities or system configurations to achieve more severe outcomes. For instance, if an attacker targets configuration files, log rotation scripts, or files included by the web server process, they may manipulate application behavior, disrupt service availability through denial of service conditions caused by corrupted critical files, or potentially escalate privileges if the overwritten file is later read with higher permissions than those held by the web server. This aligns with ATT&CK technique T1564: Hidden Files and Directories, as the attacker uses symlinks to mask their activity within standard system directories while manipulating core application logic.
To mitigate this vulnerability, administrators must upgrade Grav CMS to version 2.0.16 or later, where the developers have addressed the insecure file handling practices in the Scheduler component. Beyond upgrading, it is advisable to review server configurations regarding temporary directory usage. Implementing strict permissions on /tmp directories using mechanisms like tmpfs with restricted access can prevent local users from creating symlinks that affect other processes. Additionally, applications should utilize secure temporary file creation functions such as mkstemp() which generate unique filenames atomically and do not follow symbolic links in the same predictable manner, thereby neutralizing this class of symlink following attacks entirely.