CVE-2026-72820 in Grav
Summary
by MITRE • 08/14/2026
Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
Grav is a modern open-source flat-file content management system that relies on simple file-based storage rather than database backends. The vulnerability affects versions prior to 2.0.13 and stems from inadequate input validation within the backup profile configuration functionality. This flaw exists in the path validation logic that governs where backup archives can be created, specifically within the backup profile management system that allows users to define custom backup destinations.
The technical implementation of this vulnerability resides in the backup profile root path validation mechanism which fails to adequately sanitize user-provided directory paths. When attackers possess profile editor access rights, they can manipulate backup configuration settings to specify traversal paths that escape the intended GRAV_ROOT directory boundaries. This occurs because the system does not sufficiently verify or restrict directory traversal sequences such as ../ or ..\ that would allow navigation outside the designated safe areas.
The operational impact of this vulnerability is significant for environments where Grav instances are deployed with user access that includes backup profile editing capabilities. Attackers can leverage this privilege to create backup archives containing sensitive data from critical system locations including /opt for application binaries, /mnt for mounted filesystems, and /srv for service data. This exposure creates potential for data exfiltration, system reconnaissance, and unauthorized access to system resources that should remain protected from standard user access paths.
The vulnerability aligns with CWE-23 (Relative Path Traversal) and CWE-73 (External Control of File Name or Path) which categorize path traversal flaws in software applications. From an adversarial perspective, this weakness maps to ATT&CK technique T1078.004 (Valid Accounts: Cloud Infrastructure) and T1566.002 (Phishing: Spearphishing Attachments) when attackers gain initial access through compromised user credentials with sufficient privileges. The attack chain typically begins with an attacker obtaining profile editor access, either through credential compromise or privilege escalation, followed by configuration manipulation to establish malicious backup targets.
Mitigation strategies should include immediate upgrade to Grav version 2.0.13 or later which implements proper path validation and sanitization. Organizations should also implement principle of least privilege access controls to restrict backup profile editing capabilities to only trusted administrative users. Additional protective measures include monitoring backup configuration changes, implementing file system access controls that prevent unauthorized directory traversal, and conducting regular security assessments of application configurations. Network segmentation and intrusion detection systems can help identify suspicious backup activity patterns that may indicate exploitation attempts.