Vulnerabilities CVE-2026-72820

CVE-2026-72820

Medium

Open

TLP:CLEAR

Grav 2.0.11 Path Traversal via Backup Profile Configuration

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAV_ROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from locations like /opt, /mnt, or /srv.

Details

CVSS Score: 6.9
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 14, 2026
Last Modified: Aug 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.