CVE-2026-72820 Grav 2.0.11 Path Traversal via Backup Profile Configuration
Attackers with profile editor access can exploit path traversal in backup profiles to read sensitive files outside the web root.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72820?
CVE-2026-72820 is a medium-severity path traversal vulnerability in getgrav grav, published on 14 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.
Weakness: CWE-22
Which versions are affected by CVE-2026-72820?
How do I fix CVE-2026-72820?
No fix has been published for CVE-2026-72820 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72820 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72820 exists.
Sources
Also known as GHSA-fch7-cpv4-w7hg, GHSA-qf4h-jxxc-wvr9.