CVE-2026-72696: Improper Link Resolution Before File Access ('Link Following') in getgrav grav

CVE-2026-72696 describes a symlink following vulnerability in Grav CMS prior to version 2.0.16. The flaw exists in the Scheduler Job::createLockFile() function, which does not properly validate lock file paths before file access. An attacker with local access can pre-create symbolic links at predictable lock file locations within a world-writable temp directory. When the scheduled job runs, it follows these symlinks and overwrites the target files with the job ID string, enabling arbitrary file overwrite if the web server has write permissions on those files.

This vulnerability allows local attackers to overwrite arbitrary files that the web server process can write to. This can lead to unauthorized modification of files, potentially affecting system integrity or application behavior. The CVSS 4.0 score is 8.6 (high severity), reflecting the significant impact of arbitrary file overwrite with low attack complexity and no user interaction required.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict local access to the server and limit write permissions on the world-writable temporary directory to prevent symlink creation by untrusted users.