CVE-2026-72820 is a path traversal vulnerability affecting Grav CMS versions prior to 2.0.13. The issue stems from improper validation of backup profile root paths, which enables attackers with profile editor privileges to specify traversal paths that escape the GRAV_ROOT directory. This can lead to unauthorized exposure of files from directories outside the application root, including sensitive system directories. The vulnerability requires authenticated access with profile editor rights and does not involve user interaction or privilege escalation beyond that role.

An attacker with profile editor access can exploit this vulnerability to archive and access files outside the intended Grav root directory, potentially exposing sensitive system files from locations such as /opt, /mnt, or /srv. This could lead to information disclosure but requires authenticated access with specific privileges. There is no indication of remote code execution or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict profile editor access to trusted users only and monitor backup profile configurations for suspicious path traversal attempts.