CVE-2026-72820: Grav 2.0.11 Path Traversal via Backup Profile Configuration

Q: What is the severity of CVE-2026-72820?

The severity of CVE-2026-72820 is classified as medium with a score of 4.9.

Q: How do I fix CVE-2026-72820?

To fix CVE-2026-72820, upgrade Grav to version 2.0.13 or later.

Q: What type of vulnerability is CVE-2026-72820?

CVE-2026-72820 is a Path Traversal vulnerability.

Q: Which versions of Grav are affected by CVE-2026-72820?

Grav versions before 2.0.13 are affected by CVE-2026-72820.

Published Aug 14, 2026

Updated

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

Affected Software

1 affected component

Grav Grav<2.0.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade grav to a version that resolves this vulnerability.
Fixed in 2.0.13
Upgrade
Upgrade grav to a version that resolves this vulnerability.
Patch Grav 2.0.11 Path Traversal via Backup Profile Configuration

Event History

Aug 14, 2026

CVE Published

via MITRE·11:35 AM

Data Sourced

via MITRE·11:35 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72820?

The severity of CVE-2026-72820 is classified as medium with a score of 4.9.

How do I fix CVE-2026-72820?

To fix CVE-2026-72820, upgrade Grav to version 2.0.13 or later.

What type of vulnerability is CVE-2026-72820?

CVE-2026-72820 is a Path Traversal vulnerability.

What can attackers do with CVE-2026-72820?

Attackers with profile editor access can configure backup profiles that expose sensitive files from directories outside GRAV_ROOT.

Which versions of Grav are affected by CVE-2026-72820?