CVE-2026-72820 getgrav CVE debrief

Who should care

Grav administrators and security teams should assess exposure and prioritize remediation based on the CVE record and NVD entry details. They should verify Grav installations and update to version 2.0.13 or later. Security teams should also restrict profile editor access to trusted users and groups, monitor backup profiles for suspicious activity, and implement additional security measures to protect sensitive files and directories. This vulnerability has a

Why it matters

CVE-2026-72820 is a medium-severity vulnerability in Grav versions before 2.0.13, allowing attackers with profile editor access to archive directories outside GRAV_ROOT. Defenders should prioritize remediation and verify exposure.

• Verify Grav installations and update to version 2.0.13 or later
• Restrict profile editor access to trusted users and groups
• Monitor backup profiles for suspicious activity
• Implement additional security measures to protect sensitive files and directories

Technical summary

The CVE record and NVD entry describe a path traversal vulnerability in Grav versions before 2.0.13. The vulnerability allows attackers with profile editor access to configure backup profiles with traversal paths, potentially exposing sensitive files from locations like /opt, /mnt, or /srv. This could lead to unauthorized access to sensitive information. The vulnerability has a medium severity with a CVSS score of 6.9. Defenders should prioritize remediation and verify exposure based on the CVE record and NVD entry details.

Defensive priority

Medium priority for Grav administrators and security teams

Recommended defensive actions

• Review and update Grav installations to version 2.0.13 or later
• Restrict profile editor access to trusted users and groups
• Monitor backup profiles for suspicious activity
• Implement additional security measures to protect sensitive files and directories
• Verify Grav installations and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on a path traversal vulnerability in Grav versions before 2.0.13. The vulnerability allows attackers with profile editor access to archive directories outside GRAV_ROOT.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.