CVE-2026-72697 getgrav CVE debrief

Who should care

Administrators of Grav CMS installations, especially those with untrusted users having page authoring privileges, should prioritize patching to prevent potential file system exploitation. Additionally, security teams and vulnerability management teams should review the vulnerability details and assess their exposure to this vulnerability. Operators of affected systems should also take note of this vulnerability and plan for remediation.

Technical summary

CVE-2026-72697 is a path traversal vulnerability in Grav CMS before 2.0.16. The media_directory() Twig function fails to validate filesystem paths, allowing authenticated users with page authoring privileges to enumerate and access files outside intended scope. Attackers can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access. This vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Defensive priority

Authenticated users with page authoring privileges can exploit this vulnerability; prioritize patching for high-risk systems.

Recommended defensive actions

• Apply patches for Grav CMS version 2.0.16 or later
• Restrict access to sensitive files and directories
• Monitor for suspicious file access attempts
• Limit page authoring privileges to trusted users
• Regularly review and update access controls

Evidence notes

The CVE-2026-72697 record indicates a path traversal vulnerability in Grav CMS before 2.0.16. Details are limited beyond official sources. Defenders should verify affected deployments, review official advisories, and monitor for suspicious file access attempts. The vulnerability allows authenticated users with page authoring privileges to enumerate and access files outside intended scope. Evidence is limited, and further review is necessary to understand the full impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.