CVE-2026-72696 is a symlink following vulnerability in Grav CMS prior to version 2.0.16. The issue exists in the Scheduler Job::createLockFile() method, which creates lock files in a world-writable temporary directory. An attacker with local access can pre-create a symbolic link at the expected lock file path pointing to any file writable by the web server process. When the scheduled job executes, it follows the symlink and overwrites the target file's content with the job ID string, leading to arbitrary file overwrite.

This vulnerability allows local attackers to overwrite arbitrary files that the web server process can write to, potentially leading to data corruption, privilege escalation, or denial of service depending on the overwritten file. The CVSS 4.0 score is 8.6 (high severity), reflecting the significant impact of arbitrary file overwrite without requiring user interaction or privileges beyond local access.

No official patch or remediation is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, restrict local access to trusted users only and limit write permissions on the temporary directory to prevent symlink creation at predictable lock file paths.