CVE-2026-72820: Grav 2.0.11 Path Traversal via Backup Profile Configuration

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-09-08
Weakness: CWE-22

Description

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

Affected products

getgrav grav: from 2.0.11 before 2.0.13 — fixed in 2.0.13

How to fix

Upgrade to a fixed version: getgrav grav 2.0.13. Check the vendor advisory for mitigations.

References

https://github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892
https://github.com/getgrav/grav/security/advisories/GHSA-fch7-cpv4-w7hg
https://www.vulncheck.com/advisories/grav-path-traversal-via-backup-profile-configuration
https://github.com/getgrav/grav/security/advisories/GHSA-fch7-cpv4-w7hg

Get alerted when CVE-2026-72820 or the next vulnerability affects your stack