CVE-2026-72695 getgrav CVE debrief

Who should care

Users of Grav before version 2.0.16, especially those with media management permissions, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and restricting media management permissions, monitoring for suspicious activity, and updating Grav to version 2.0.16 or later. Additionally, system administrators and security teams should assess their exposure and implement compensating controls if necessary.

Technical summary

The CVE-2026-72695 record indicates a path traversal vulnerability in Grav before 2.0.16, specifically in MediaUploadTrait::deleteFile(). Authenticated users with media management permissions can delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory. This vulnerability allows for potential data breaches and system compromise.

Defensive priority

Authenticated users with media management permissions can delete arbitrary files.

Recommended defensive actions

• Inventory affected Grav installations and verify media management permissions.
• Restrict media management permissions to trusted users.
• Monitor for suspicious file deletion activity.
• Update Grav to version 2.0.16 or later.
• Implement additional access controls and file system restrictions.

Evidence notes

The CVE-2026-72695 record indicates a path traversal vulnerability in Grav before 2.0.16, specifically in MediaUploadTrait::deleteFile(). Authenticated users with media management permissions can delete arbitrary files by supplying filenames with directory traversal sequences. Evidence is limited to CVE and NVD details. Defenders should verify affected Grav installations, review media management permissions, and monitor for suspicious file deletion activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.