CVE-2026-72820 is a path traversal vulnerability in Grav CMS versions prior to 2.0.13, specifically confirmed in version 2.0.11. The vulnerability arises because Grav fails to properly validate backup profile root paths, allowing attackers who have profile editor privileges to specify traversal paths. This can lead to archiving and exposure of files outside the intended GRAV_ROOT directory, bypassing the hard-coded deny-list. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and does not require user interaction but does require elevated privileges (profile editor access).

An attacker with profile editor access can exploit this vulnerability to archive and potentially access sensitive files located outside the Grav root directory, including system directories such as /opt, /mnt, or /srv. This could lead to unauthorized disclosure of sensitive information stored in these locations. The vulnerability does not allow privilege escalation or remote code execution by itself but can expose sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict profile editor access to trusted users only and monitor backup profile configurations for suspicious path traversal patterns.